# 4.19.56

Created: 2026-11-12 23:35:56 +0000 UTC

Image Digest: `sha256:4772fcd709ee09958d4fa9bbea6dbde6f345603dfe64237bd5fc52b60902798f`


## Changes from 4.19.41

### Components

* Kubectl 1.32.1
* Kubernetes 1.32.13
* Kubernetes Tests 1.32.8
* Red Hat Enterprise Linux CoreOS upgraded from 9.6.20260727-0 to 9.6.20261109-1



### FeatureGate Changes
| FeatureGate | Default<br/>Hypershift | Default<br/>SelfManagedHA | DevPreviewNoUpgrade<br/>Hypershift | DevPreviewNoUpgrade<br/>SelfManagedHA | TechPreviewNoUpgrade<br/>Hypershift | TechPreviewNoUpgrade<br/>SelfManagedHA  |
| :------ | :---: | :---: | :---: | :---: | :---: | :---:  |
| VSphereMultiVCenterDay2 <br/> (0 tests)|  |  | Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New)| Enabled<br/>(New) |


### Rebuilt images without code change

* [agent-installer-utils](https://github.com/openshift/agent-installer-utils) git [34af4548](https://github.com/openshift/agent-installer-utils/commit/34af4548d9d162c4e07e7426d4c672d8fbc3500c) `sha256:22aa6a23a0a5c17176af59574a23575a6f21e9a9a29a989de3aed4be8c7477e0`
* [apiserver-network-proxy](https://github.com/openshift/apiserver-network-proxy) git [77213cc5](https://github.com/openshift/apiserver-network-proxy/commit/77213cc5eed50f6c0ec0600133e01274020657ef) `sha256:26ba8cff96eba8cd682c8c70130c1847397c276b678211c4acf41ecd0293ecc3`
* [aws-cloud-controller-manager](https://github.com/openshift/cloud-provider-aws) git [425c1c5b](https://github.com/openshift/cloud-provider-aws/commit/425c1c5be39628421bdfb63caf25beb169307473) `sha256:a14d6fd34e5c3ee9dffd1072d62c0496554e20a72840d550f4a172d2952ea47a`
* [aws-karpenter-provider-aws](https://github.com/openshift/aws-karpenter-provider-aws) git [68ae0c26](https://github.com/openshift/aws-karpenter-provider-aws/commit/68ae0c265271b4447f42decf88c6a44b343eeec9) `sha256:6d7a2095e22e56b03899d9ec96c48566d1acf15c4f5c85c1c25e19767457bb59`
* [aws-kms-encryption-provider](https://github.com/openshift/aws-encryption-provider) git [65915f01](https://github.com/openshift/aws-encryption-provider/commit/65915f01ac0077888c21cd6450cba2a9e2d998ad) `sha256:95b3bc288301c1315bf1abdebd93adb32a0731729cae9813e65d54b1af42912a`
* [azure-service-operator](https://github.com/openshift/azure-service-operator) git [3bb352c1](https://github.com/openshift/azure-service-operator/commit/3bb352c18a940bf419a3ed8b1e7e5f23c3ba286e) `sha256:08f5ceefa1f550472177a9adb6ce0cbff011a2e05ce70b20829513e741cf4a18`
* [baremetal-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-metal3) git [06a66db1](https://github.com/openshift/cluster-api-provider-metal3/commit/06a66db1ac3c28f6d9a1adf16146ebec219c8534) `sha256:b8ab24ab1267e25e1d127be52a1b28fc1692a9adc44c19793e3e8d1bb242122f`
* [baremetal-operator](https://github.com/openshift/baremetal-operator) git [8fa7f68f](https://github.com/openshift/baremetal-operator/commit/8fa7f68fd41fa2bb78cd8f0a4d758c703b37a672) `sha256:dbb1cb722292a2200cf2d8ad37cf2f6e181de8d4ff0368d8ee09d26b8ba56ea2`
* [cluster-bootstrap](https://github.com/openshift/cluster-bootstrap) git [8fde9c52](https://github.com/openshift/cluster-bootstrap/commit/8fde9c52fbb6b6044785ebae0751000b049fd0ed) `sha256:9670a132005bf81d84b8d549296d093a8f65dcf51a2d804d90f6a07c460dd3fa`
* [cluster-capi-controllers](https://github.com/openshift/cluster-api) git [42b8aeca](https://github.com/openshift/cluster-api/commit/42b8aeca8d812175660e6b372fc2145792b48f2d) `sha256:eb54a552fca8958f212eef85f125a2e59e016fa4f5eed28daa0e9ee6443b4bc2`
* [cluster-capi-operator](https://github.com/openshift/cluster-capi-operator) git [cc2093ef](https://github.com/openshift/cluster-capi-operator/commit/cc2093ef2d72cd3cf0a42519f5e791e1b95ed6a5) `sha256:f24955cf3a36bbf278deede2270e663970f8a9a949c189efe2c72c3e9d4ba1ba`
* [cluster-config-operator](https://github.com/openshift/cluster-config-operator) git [96607b59](https://github.com/openshift/cluster-config-operator/commit/96607b590ba35a8f008073e105e01e72a5bfba2e) `sha256:3f8deb5d7b6eb16b82597105f8ca8002b9f9fa9a43059f657d89775ee9b01e68`
* [cluster-control-plane-machine-set-operator](https://github.com/openshift/cluster-control-plane-machine-set-operator) git [1dbf0c7a](https://github.com/openshift/cluster-control-plane-machine-set-operator/commit/1dbf0c7a5d513dedcc18de0ee5fb34e18b8b53f2) `sha256:ba4a796d0f96be73c583bc0a9116ca6fb5855d9bd22f0f99ad6e4bae7fde7415`
* [cluster-image-registry-operator](https://github.com/openshift/cluster-image-registry-operator) git [3335b120](https://github.com/openshift/cluster-image-registry-operator/commit/3335b120ecbae4a792373a814474aeebde58d6c2) `sha256:b06154dc3ab6e7cf3edf72047b33f26e24e2890d7442d375842ac96c15dd4c2f`
* [cluster-kube-cluster-api-operator](https://github.com/openshift/cluster-api-operator) git [21f85831](https://github.com/openshift/cluster-api-operator/commit/21f858318e12e7fc2304ea6d3639680b6863a597) `sha256:92c962cad5a86a02d19674977ff33f6bea36afb71f26948c669a3565c291a5c9`
* [cluster-kube-storage-version-migrator-operator](https://github.com/openshift/cluster-kube-storage-version-migrator-operator) git [4e514049](https://github.com/openshift/cluster-kube-storage-version-migrator-operator/commit/4e51404906f0648304e81414e0d299c52214f7a8) `sha256:45146de3a7ef2393b73bf01db2583333a1e5a76c32bf2dfd4fea4425de1df850`
* [cluster-openshift-apiserver-operator](https://github.com/openshift/cluster-openshift-apiserver-operator) git [5f66a3e1](https://github.com/openshift/cluster-openshift-apiserver-operator/commit/5f66a3e13fd98eaaa0941e8e0724b1f56a797d6d) `sha256:959827b762a95c9f1c18f64f825df14adf08f795527fa19c65dc96abb00828be`
* [cluster-openshift-controller-manager-operator](https://github.com/openshift/cluster-openshift-controller-manager-operator) git [0ab30996](https://github.com/openshift/cluster-openshift-controller-manager-operator/commit/0ab30996207ada63ef2e2fd4f47aac03b0872c9a) `sha256:9c7c33cfe2da118d29c5ab1cedc04dd0d277ed97735228a8ba055653f766b9a5`
* [cluster-update-keys](https://github.com/openshift/cluster-update-keys) git [0ea36f0a](https://github.com/openshift/cluster-update-keys/commit/0ea36f0a4c0ad6a6abc81a91b2ac87d68d294020) `sha256:2957b8693dd02a99f3840de23835c0a5c7377e0481c2e3d64689ec4236455118`
* [configmap-reloader](https://github.com/openshift/configmap-reload) git [a2a48a3a](https://github.com/openshift/configmap-reload/commit/a2a48a3a767fdb70644c65ab863bd4fc125987d2) `sha256:8f7289ffa4e5f41db004b799d160abd70648163d5a2369cddf2e9f8b714fb298`
* [container-networking-plugins](https://github.com/openshift/containernetworking-plugins) git [810a3b3f](https://github.com/openshift/containernetworking-plugins/commit/810a3b3f62b0c0c981813e2c8ee70ae24e30fca1) `sha256:958ec996fec90118e8b2cc897c61637bbf90d7fe060447416002f00b206eea9e`
* [containernetworking-plugins-microshift](https://github.com/openshift/containernetworking-plugins) git [810a3b3f](https://github.com/openshift/containernetworking-plugins/commit/810a3b3f62b0c0c981813e2c8ee70ae24e30fca1) `sha256:5239b0b930b9dd6797655c63b5763af39d97b85a1868b94a8c885b6718abdb5c`
* [csi-node-driver-registrar](https://github.com/openshift/csi-node-driver-registrar) git [fa578445](https://github.com/openshift/csi-node-driver-registrar/commit/fa578445467753d2a000cb1ba1cb5dc91cfb9542) `sha256:88b8c2233500d18fadb7182ae15b805b00b84cd4623c2225f99f371de9c97a93`
* [driver-toolkit](https://github.com/openshift/driver-toolkit) git [686fdac5](https://github.com/openshift/driver-toolkit/commit/686fdac595884ade83fef7b2b9c41169bf3fcb21) `sha256:29a9a1a3dd0f25e30417c04ff7a84db8c17777cb55ac5a24ff3e7738aaaf259f`
* [egress-router-cni](https://github.com/openshift/egress-router-cni) git [b9ba5d49](https://github.com/openshift/egress-router-cni/commit/b9ba5d49ffcd39bbd9a54033032496985bd99489) `sha256:4bd638e6478bf58b88b8be696073c9d2d417019f390c31ff6fddd1feedd42105`
* [etcd](https://github.com/openshift/etcd) git [3ebce536](https://github.com/openshift/etcd/commit/3ebce536634cb76794f1b9668072a094c132c16a) `sha256:610c3404490b4ea83a469655d5f2ae7dc224d5739890d1156d0d82fe02953a27`
* [hyperkube](https://github.com/openshift/kubernetes) git [63adf010](https://github.com/openshift/kubernetes/commit/63adf010aa20e104c0b7043b47f42f50c9f72b17) `sha256:80b104eebe970110291147a0a7060789d068d80e2bcdaed49f266fbf42586784`
* [ironic-machine-os-downloader](https://github.com/openshift/ironic-rhcos-downloader) git [dacba7d7](https://github.com/openshift/ironic-rhcos-downloader/commit/dacba7d7809a048392d18050096dcc20f2878b6f) `sha256:19408952b840bfb7a2377d42142e7851660459922b1baee5a076b926760b2ea6`
* [ironic-static-ip-manager](https://github.com/openshift/ironic-static-ip-manager) git [fcd9564e](https://github.com/openshift/ironic-static-ip-manager/commit/fcd9564e3bfa12e45576af376d168b5036dd8206) `sha256:d793efdacd105a3a0230adeb94b0cda3295e5a52c3032fd287bcdeeac669094a`
* [keepalived-ipfailover](https://github.com/openshift/images) git [b42e7cf2](https://github.com/openshift/images/commit/b42e7cf218c4eef071cc29e0894fe8cfaed80b7f) `sha256:13bd0a99a22af56f3657d4efe3dac6fe3127493f3af0cf30623ccc6594d8c273`
* [kube-proxy](https://github.com/openshift/kubernetes) git [63adf010](https://github.com/openshift/kubernetes/commit/63adf010aa20e104c0b7043b47f42f50c9f72b17) `sha256:884c3ce3f0eca38fef1e1b8fcd814bbaafb65b3d0d0f2f3add856b91c0aa9fa1`
* [kube-rbac-proxy](https://github.com/openshift/kube-rbac-proxy) git [59127756](https://github.com/openshift/kube-rbac-proxy/commit/591277560f328601273f88f2881e09ccccd90a97) `sha256:a1c5fb9d4240d5b1a281368b4d7afadbe417e62d3a5b20954e606de85ac15858`
* [kube-storage-version-migrator](https://github.com/openshift/kubernetes-kube-storage-version-migrator) git [fdef30c8](https://github.com/openshift/kubernetes-kube-storage-version-migrator/commit/fdef30c84b3d45ede364500984221c3f492b1415) `sha256:57da3dce14ee46e2e43999a3c40aae60df512f9d57e8165a0838cc3d6f2d2e61`
* [kubevirt-csi-driver](https://github.com/openshift/kubevirt-csi-driver) git [f7dbbba1](https://github.com/openshift/kubevirt-csi-driver/commit/f7dbbba1f6134ac84ad00e6849003a75c4b4a076) `sha256:cce0edf7bc01b4e62517b0c907205cbb10e5f1bb6ffdee4ac253ddd5087b822e`
* [libvirt-machine-controllers](https://github.com/openshift/cluster-api-provider-libvirt) git [be869073](https://github.com/openshift/cluster-api-provider-libvirt/commit/be869073822c90e5d2e026f6af76a20d7e570ccc) `sha256:1124dba21c8ae2e21edb131e45418389f26cd470c03657e2f22b9e89ea836771`
* [machine-os-images](https://github.com/openshift/machine-os-images) git [147cdd71](https://github.com/openshift/machine-os-images/commit/147cdd71cfee75248abb8138990e82ea8376b3d4) `sha256:10257b4a7f1c20638e6bcc57ed5c5076ee0b9d11461644c7f64152e337b28275`
* [metallb-frr](https://github.com/openshift/frr) git [9c93b083](https://github.com/openshift/frr/commit/9c93b083918f4266b7139ae39207c12cd4824345) `sha256:ec19ceb3f9f6b9695b6cb2cb91d0df133602a2c9742194beda5289f24316c7e3`
* [multus-route-override-cni](https://github.com/openshift/route-override-cni) git [391c1b03](https://github.com/openshift/route-override-cni/commit/391c1b0361e17c5718508810f0bdb6ff66ae6e81) `sha256:36ddf4ac8ab45919f99be71b31dad63cebc4497d5712c645aa48e9d9b73f1a3c`
* [must-gather](https://github.com/openshift/must-gather) git [cbe044bc](https://github.com/openshift/must-gather/commit/cbe044bce8937a811d97719e13b1459d9e8b1fb0) `sha256:e3c70469b2e9247c15afb7ab597d2652db33ad7ba1c881b3ced3695529f23954`
* [network-interface-bond-cni](https://github.com/openshift/bond-cni) git [fd8f506d](https://github.com/openshift/bond-cni/commit/fd8f506d59353ac89db5c8015969e81dafdab774) `sha256:414e76e8c1234cd13b30cdcc9be17235955d605a5dd68630cb39913a05dea85d`
* [network-tools](https://github.com/openshift/network-tools) git [633767b2](https://github.com/openshift/network-tools/commit/633767b26eb0d7c69e370599d40458e72e7d1a69) `sha256:426f507c305ebae192328cb1316b4df374b5f3a850ca1b3ad2ac4991f46f72ab`
* [nutanix-machine-controllers](https://github.com/openshift/machine-api-provider-nutanix) git [a26db5a0](https://github.com/openshift/machine-api-provider-nutanix/commit/a26db5a04ecffd98c6a9ee8204af621bf2416ec9) `sha256:0c2a28716b5c20bed018b21d91ed371eb6fb0d62471f522186f0da8d8a2c604f`
* [openstack-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-openstack) git [bd1fc704](https://github.com/openshift/cluster-api-provider-openstack/commit/bd1fc7041d18f108120a86a4429c4f45b624b04b) `sha256:0ccd016df7aca18fbfbe2b790bb12569d9fc1c41de8cfb17f79d899c5d0fd693`
* [openstack-machine-api-provider](https://github.com/openshift/machine-api-provider-openstack) git [bc4fe51d](https://github.com/openshift/machine-api-provider-openstack/commit/bc4fe51daf4f4a9329ec15745b0b3b9188f23729) `sha256:77b40420411db74d045e68e79df68afa028d440324ab22987e29c54feeb08df7`
* [operator-marketplace](https://github.com/operator-framework/operator-marketplace) git [ca41bfdd](https://github.com/operator-framework/operator-marketplace/commit/ca41bfdd1a96f70632ea3d218a9a007ecbcf76f5) `sha256:55de57b99ea2e4ab1dd9c12cdbadc1c1e3f89a8e05b1858d04c807ad19a03a1e`
* [pod](https://github.com/openshift/kubernetes) git [63adf010](https://github.com/openshift/kubernetes/commit/63adf010aa20e104c0b7043b47f42f50c9f72b17) `sha256:f0e6da1e3e83542b16a539ad1cbc641a128da8303ed6933761b95e5b4b3b91f5`
* [powervs-block-csi-driver](https://github.com/openshift/ibm-powervs-block-csi-driver) git [c96184e9](https://github.com/openshift/ibm-powervs-block-csi-driver/commit/c96184e9ef1c49b83ebbde7aa5610d24ea3ff6ac) `sha256:f26340327d2377988f6961b431d952c1bd6df6a59fbece5565837c684649cf96`
* [powervs-cloud-controller-manager](https://github.com/openshift/cloud-provider-powervs) git [fd25fd0b](https://github.com/openshift/cloud-provider-powervs/commit/fd25fd0b25a51474d045d74fd571ecb4d1e7f3c5) `sha256:2ed3da4491ce8e77a0cc22ae1966daaa36edaebcf230b022073eab26cd90f933`
* [powervs-machine-controllers](https://github.com/openshift/machine-api-provider-powervs) git [ff6e9a8e](https://github.com/openshift/machine-api-provider-powervs/commit/ff6e9a8e1ea2eebb552cdc64974f8f6e7e5cbd1a) `sha256:d754ff36576865b9f20e2d6bee88c0560b39e7822a7ad511180d4cb5919b737e`
* [service-ca-operator](https://github.com/openshift/service-ca-operator) git [4dfa6916](https://github.com/openshift/service-ca-operator/commit/4dfa6916f984d0fd7188380edc88b250738f07f7) `sha256:c6ffbb3c636995cebf6a12620d065255542ec0526ccac8270731eb6b7ad820c4`
* [telemeter](https://github.com/openshift/telemeter) git [4da8f469](https://github.com/openshift/telemeter/commit/4da8f469ce9059cfacc55fd3f83e2b32a56de444) `sha256:e8831a9a6d60c32e8988abf90d7182e97477749ad601ac61729c94c063692b42`
* [thanos](https://github.com/openshift/thanos) git [a4c98b85](https://github.com/openshift/thanos/commit/a4c98b8568a067fcb499cd040a5177b31ea1832b) `sha256:40d016e2fcd201686d36a629e49dfd0133a6acc2459fae5f12a724b77b220516`


### [agent-installer-api-server](https://github.com/openshift/assisted-service/tree/b9a9b450c13bd60e1af03846613c7e5d3b11bf52)

* [OCPBUGS-89930](https://issues.redhat.com/browse/OCPBUGS-89930): patching golang.org/x/crypto with sustaining/crypto@v0.33.0-sec.2 [#10799](https://github.com/openshift/assisted-service/pull/10799)
* [Full changelog](https://github.com/openshift/assisted-service/compare/de5d04b1db10aa8b3864d1e8f42a7fc23aadd4ae...b9a9b450c13bd60e1af03846613c7e5d3b11bf52)


### [agent-installer-csr-approver, agent-installer-orchestrator](https://github.com/openshift/assisted-installer/tree/701bea01c212116915a877f011095460a7801b7a)

* [OCPBUGS-103563](https://issues.redhat.com/browse/OCPBUGS-103563): Bump x/net to v0.35.0-sec.4 [#2290](https://github.com/openshift/assisted-installer/pull/2290)
* [Full changelog](https://github.com/openshift/assisted-installer/compare/0de29205c8b99bdfdc12271281d5830f185d8f8c...701bea01c212116915a877f011095460a7801b7a)


### [agent-installer-node-agent](https://github.com/openshift/assisted-installer-agent/tree/dd543190cf2e911b5db6166a6c3020116d61d630)

* [OCPBUGS-103566](https://issues.redhat.com/browse/OCPBUGS-103566): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#1619](https://github.com/openshift/assisted-installer-agent/pull/1619)
* [Full changelog](https://github.com/openshift/assisted-installer-agent/compare/1753a85e3d8cf18e10bdf35c3a4ac87a74cab44e...dd543190cf2e911b5db6166a6c3020116d61d630)


### [aws-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-aws/tree/fc783d104e4980cfa8e441dc465c423e90b3a4cf)

* 🐛 OCPBUGS-134666: UPSTREAM: 6132: Persist ProviderID immediately after instance creation [#667](https://github.com/openshift/cluster-api-provider-aws/pull/667)
* [OCPBUGS-103572](https://issues.redhat.com/browse/OCPBUGS-103572): replace golang.org/x/net with openshift-sustaining/net v0.35.0-sec.4 for CVE-2026-33814 [#651](https://github.com/openshift/cluster-api-provider-aws/pull/651)
* 🐛 OCPBUGS-123677: UPSTREAM: &lt;carry&gt;: Fix unit tests for OpenShift CI environment [#640](https://github.com/openshift/cluster-api-provider-aws/pull/640)
* 🌱 OCPBUGS-123613: UPSTREAM: &lt;carry&gt;: Remove upstream .github files unused in OpenShift CI [#639](https://github.com/openshift/cluster-api-provider-aws/pull/639)
* [Full changelog](https://github.com/openshift/cluster-api-provider-aws/compare/0a740b04471ca2bc5bb7a3034e78a62cfc2c24a2...fc783d104e4980cfa8e441dc465c423e90b3a4cf)


### [aws-ebs-csi-driver](https://github.com/openshift/aws-ebs-csi-driver/tree/7525342687abb1f38024273b750102f19993ab33)

* [OCPBUGS-90351](https://issues.redhat.com/browse/OCPBUGS-90351): patching golang.org/x/crypto with sustaining/crypto@v0.41.0-sec.5 [#351](https://github.com/openshift/aws-ebs-csi-driver/pull/351)
* [Full changelog](https://github.com/openshift/aws-ebs-csi-driver/compare/c6b30f20d3102016749dec90e8be4574caaa3368...7525342687abb1f38024273b750102f19993ab33)


### [aws-ebs-csi-driver-operator, azure-disk-csi-driver-operator, azure-file-csi-driver-operator, csi-driver-manila-operator, openstack-cinder-csi-driver-operator](https://github.com/openshift/csi-operator/tree/1601562a8f619cd76f3cbc5eb2163f61e476f218)

* [OCPBUGS-103638](https://issues.redhat.com/browse/OCPBUGS-103638), [OCPBUGS-103715](https://issues.redhat.com/browse/OCPBUGS-103715), [OCPBUGS-103746](https://issues.redhat.com/browse/OCPBUGS-103746): replace golang.org/x/net with openshift-sustaining fork [#633](https://github.com/openshift/csi-operator/pull/633)
* [OCPBUGS-103592](https://issues.redhat.com/browse/OCPBUGS-103592), [OCPBUGS-103601](https://issues.redhat.com/browse/OCPBUGS-103601): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#611](https://github.com/openshift/csi-operator/pull/611)
* [Full changelog](https://github.com/openshift/csi-operator/compare/735dc3c611fa79701ebe42ef01ec8f4fab84d2b5...1601562a8f619cd76f3cbc5eb2163f61e476f218)


### [aws-machine-controllers](https://github.com/openshift/machine-api-provider-aws/tree/86831315fa53e6989616e752a4853cd3ca68456c)

* [OCPBUGS-103693](https://issues.redhat.com/browse/OCPBUGS-103693): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#208](https://github.com/openshift/machine-api-provider-aws/pull/208)
* [Full changelog](https://github.com/openshift/machine-api-provider-aws/compare/14f4b995a810d26516d5f1c88f7bee1d524686b0...86831315fa53e6989616e752a4853cd3ca68456c)


### [aws-pod-identity-webhook](https://github.com/openshift/aws-pod-identity-webhook/tree/70292e7f8bcee71120c47db932336269371019d8)

* [OCPBUGS-103598](https://issues.redhat.com/browse/OCPBUGS-103598): Bump golang.org/x/net to v0.43.0-sec.3 [#224](https://github.com/openshift/aws-pod-identity-webhook/pull/224)
* [Full changelog](https://github.com/openshift/aws-pod-identity-webhook/compare/b0a16d53fbf28a55110bbb36a69f23bc772b3297...70292e7f8bcee71120c47db932336269371019d8)


### [azure-cloud-controller-manager, azure-cloud-node-manager](https://github.com/openshift/cloud-provider-azure/tree/b249afb943993264abdb7829e770e16f6df04732)

* [OCPBUGS-103595](https://issues.redhat.com/browse/OCPBUGS-103595), [OCPBUGS-103768](https://issues.redhat.com/browse/OCPBUGS-103768): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 to address CVE-2026-33814 [#207](https://github.com/openshift/cloud-provider-azure/pull/207)
* [Full changelog](https://github.com/openshift/cloud-provider-azure/compare/6282230dc14b5bdc5ae902bfdf4aa3d2ce1fdcbd...b249afb943993264abdb7829e770e16f6df04732)


### [azure-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-azure/tree/44f7799a24d1865a30ec80c8ad54dd5a85f575c4)

* [OCPBUGS-103606](https://issues.redhat.com/browse/OCPBUGS-103606): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#404](https://github.com/openshift/cluster-api-provider-azure/pull/404)
* [OCPBUGS-89940](https://issues.redhat.com/browse/OCPBUGS-89940): Address CVE-2026-39829 [#400](https://github.com/openshift/cluster-api-provider-azure/pull/400)
* [Full changelog](https://github.com/openshift/cluster-api-provider-azure/compare/dc228673549ec5dd87f0ecf35a57bfc3ab380dc1...44f7799a24d1865a30ec80c8ad54dd5a85f575c4)


### [azure-disk-csi-driver](https://github.com/openshift/azure-disk-csi-driver/tree/0decf70e1dd637d57d1e06b89657722ba1ee517d)

* UPSTREAM: 3582: OCPBUGS-103602: Bump golang.org/x/net to v0.43.0-sec.4 [#171](https://github.com/openshift/azure-disk-csi-driver/pull/171)
* [OCPBUGS-112786](https://issues.redhat.com/browse/OCPBUGS-112786): UPSTREAM: 3277: fix: allow `.` in Azure tags [#170](https://github.com/openshift/azure-disk-csi-driver/pull/170)
* [Full changelog](https://github.com/openshift/azure-disk-csi-driver/compare/de70652140c556f46393edf885f86a96c0c6fa7c...0decf70e1dd637d57d1e06b89657722ba1ee517d)


### [azure-file-csi-driver](https://github.com/openshift/azure-file-csi-driver/tree/e409c0054eee97a7ab9ea318125573d10a0a1b3b)

* [OCPBUGS-103591](https://issues.redhat.com/browse/OCPBUGS-103591): Bump golang.org/x/net to v0.43.0-sec.4 [#157](https://github.com/openshift/azure-file-csi-driver/pull/157)
* [OCPBUGS-92920](https://issues.redhat.com/browse/OCPBUGS-92920): Bump golang.org/x/crypto to  v0.41.0-sec.2 [#147](https://github.com/openshift/azure-file-csi-driver/pull/147)
* [Full changelog](https://github.com/openshift/azure-file-csi-driver/compare/f087a2dd9c8e43f9a6a5025cb5d43e9cf663f0b1...e409c0054eee97a7ab9ea318125573d10a0a1b3b)


### [azure-kms-encryption-provider](https://github.com/openshift/azure-kubernetes-kms/tree/03fdb55d0c7970ca775ef17a8a7221d855a7a489)

* [OCPBUGS-103554](https://issues.redhat.com/browse/OCPBUGS-103554): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#60](https://github.com/openshift/azure-kubernetes-kms/pull/60)
* [Full changelog](https://github.com/openshift/azure-kubernetes-kms/compare/945244c7763c5ff5683eb2dfc0887e5e149263a4...03fdb55d0c7970ca775ef17a8a7221d855a7a489)


### [azure-machine-controllers](https://github.com/openshift/machine-api-provider-azure/tree/a829b8df984354f54fdc3e9b98a9e64d96378909)

* [OCPBUGS-103689](https://issues.redhat.com/browse/OCPBUGS-103689): replace golang.org/x/net with openshift-sustaining/net@v0.43.0-sec.4 [#212](https://github.com/openshift/machine-api-provider-azure/pull/212)
* [Full changelog](https://github.com/openshift/machine-api-provider-azure/compare/163515df04124d4e2daaab47dc6fd30a1e5b246e...a829b8df984354f54fdc3e9b98a9e64d96378909)


### [azure-workload-identity-webhook](https://github.com/openshift/azure-workload-identity/tree/5423db80d61a70a2861306d1e76f8cd416e938f6)

* [OCPBUGS-103605](https://issues.redhat.com/browse/OCPBUGS-103605): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#62](https://github.com/openshift/azure-workload-identity/pull/62)
* [OCPBUGS-81914](https://issues.redhat.com/browse/OCPBUGS-81914): CVE-2026-34986: use sustaining go-jose fork (avoids Go 1.24 bump) [#52](https://github.com/openshift/azure-workload-identity/pull/52)
* [Full changelog](https://github.com/openshift/azure-workload-identity/compare/e5c6c44c87ebbe57a33650dd6270275e7cca771e...5423db80d61a70a2861306d1e76f8cd416e938f6)


### [baremetal-installer, installer, installer-artifacts](https://github.com/openshift/installer/tree/07c2db1cd6b80fd6d5ccc8fef39b6c99524779fd)

* [OCPBUGS-90347](https://issues.redhat.com/browse/OCPBUGS-90347), [OCPBUGS-90353](https://issues.redhat.com/browse/OCPBUGS-90353): Update golang.org/x/crypto to fix CVE-2026-39830 [#11054](https://github.com/openshift/installer/pull/11054)
* [OCPBUGS-133960](https://issues.redhat.com/browse/OCPBUGS-133960): Update RHCOS-release-4.19 bootimage metadata to 9.6.20261027-0 [#11033](https://github.com/openshift/installer/pull/11033)
* [OCPBUGS-103604](https://issues.redhat.com/browse/OCPBUGS-103604), [OCPBUGS-103681](https://issues.redhat.com/browse/OCPBUGS-103681): Bump golang.org/x/net to v0.43.0-sec.4 [#10969](https://github.com/openshift/installer/pull/10969)
* [OCPBUGS-100064](https://issues.redhat.com/browse/OCPBUGS-100064): openstack: Reserve addresses for load balancer [#10722](https://github.com/openshift/installer/pull/10722)
* [OCPBUGS-89936](https://issues.redhat.com/browse/OCPBUGS-89936), [OCPBUGS-92919](https://issues.redhat.com/browse/OCPBUGS-92919): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.41.0-sec.3 [#10856](https://github.com/openshift/installer/pull/10856)
* [OCPBUGS-115289](https://issues.redhat.com/browse/OCPBUGS-115289): Update gcloud version to one that can be found [#10844](https://github.com/openshift/installer/pull/10844)
* [OCPBUGS-113537](https://issues.redhat.com/browse/OCPBUGS-113537): Update RHCOS-release-4.19 bootimage metadata to 9.6.20260818-0 [#10800](https://github.com/openshift/installer/pull/10800)
* [Full changelog](https://github.com/openshift/installer/compare/2493db4d14208d90f64b4d5951f5229d5116e725...07c2db1cd6b80fd6d5ccc8fef39b6c99524779fd)


### [baremetal-machine-controllers](https://github.com/openshift/cluster-api-provider-baremetal/tree/9b07512dd458eb6c60c2c05c45e46d7edb51f473)

* [OCPBUGS-103597](https://issues.redhat.com/browse/OCPBUGS-103597): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#267](https://github.com/openshift/cluster-api-provider-baremetal/pull/267)
* [Full changelog](https://github.com/openshift/cluster-api-provider-baremetal/compare/f7a789548f76d3117f3400ac597c0db615778d57...9b07512dd458eb6c60c2c05c45e46d7edb51f473)


### [baremetal-runtimecfg](https://github.com/openshift/baremetal-runtimecfg/tree/c17301d573cbd9c563337793be3ac588fef685ac)

* [OCPBUGS-103590](https://issues.redhat.com/browse/OCPBUGS-103590): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#407](https://github.com/openshift/baremetal-runtimecfg/pull/407)
* [Full changelog](https://github.com/openshift/baremetal-runtimecfg/compare/2f969c7a1df33a398298df731505a508ad120db9...c17301d573cbd9c563337793be3ac588fef685ac)


### [cli, cli-artifacts, deployer, tools](https://github.com/openshift/oc/tree/270921939bb63f95219f865d138f8f0208369097)

* [OCPBUGS-103551](https://issues.redhat.com/browse/OCPBUGS-103551), [OCPBUGS-103599](https://issues.redhat.com/browse/OCPBUGS-103599): Use patched x/net fork v0.43.0-sec.4 [#2419](https://github.com/openshift/oc/pull/2419)
* Fix for OCPBUGS-88243: CVE-2026-39821 [#2362](https://github.com/openshift/oc/pull/2362)
* [OCPBUGS-91095](https://issues.redhat.com/browse/OCPBUGS-91095), [OCPBUGS-94720](https://issues.redhat.com/browse/OCPBUGS-94720): Bump golang.org/x/net to openshift-sustaining/net v0.43.0-sec.2 [#2343](https://github.com/openshift/oc/pull/2343)
* [OCPBUGS-105503](https://issues.redhat.com/browse/OCPBUGS-105503), [OCPBUGS-105504](https://issues.redhat.com/browse/OCPBUGS-105504): Fix pre-existing unit test failures on release-4.19 [#2356](https://github.com/openshift/oc/pull/2356)
* [Full changelog](https://github.com/openshift/oc/compare/b2a93a639c07ebf4d547d10877b6c13f65583248...270921939bb63f95219f865d138f8f0208369097)


### [cloud-credential-operator](https://github.com/openshift/cloud-credential-operator/tree/d12f84aaad3fe67ce8337183d548ab3d4722f13a)

* [OCPBUGS-103588](https://issues.redhat.com/browse/OCPBUGS-103588): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#1099](https://github.com/openshift/cloud-credential-operator/pull/1099)
* [OCPBUGS-81917](https://issues.redhat.com/browse/OCPBUGS-81917): Bump go-jose/go-jose/v4@v4.1.4 [#1030](https://github.com/openshift/cloud-credential-operator/pull/1030)
* [Full changelog](https://github.com/openshift/cloud-credential-operator/compare/eaa3ebdcc89590be47d55fd7d474267f42b005fa...d12f84aaad3fe67ce8337183d548ab3d4722f13a)


### [cloud-network-config-controller](https://github.com/openshift/cloud-network-config-controller/tree/9eaf1ba4e0fa7ef98bf70b338147fc240a42c87e)

* [OCPBUGS-103580](https://issues.redhat.com/browse/OCPBUGS-103580): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#270](https://github.com/openshift/cloud-network-config-controller/pull/270)
* [Full changelog](https://github.com/openshift/cloud-network-config-controller/compare/49b7a9e2f1cc77fee3a8ee776d3eac8bae1be86e...9eaf1ba4e0fa7ef98bf70b338147fc240a42c87e)


### [cluster-authentication-operator](https://github.com/openshift/cluster-authentication-operator/tree/4b788a77b84fadcf4ae847899b768559d9b0dc57)

* [OCPBUGS-103609](https://issues.redhat.com/browse/OCPBUGS-103609): Bump golang.org/x/net from v0.30.0 to v0.43.0-sec.4 [#982](https://github.com/openshift/cluster-authentication-operator/pull/982)
* [OCPBUGS-86956](https://issues.redhat.com/browse/OCPBUGS-86956): Updating ose-cluster-authentication-operator-container image to be consistent with ART for 4.19 [#852](https://github.com/openshift/cluster-authentication-operator/pull/852)
* [Full changelog](https://github.com/openshift/cluster-authentication-operator/compare/1d930619673e99029a1e5cec0194b5a3580ec35a...4b788a77b84fadcf4ae847899b768559d9b0dc57)


### [cluster-autoscaler](https://github.com/openshift/kubernetes-autoscaler/tree/7243a8cc65c8c0f28290149993e4e6de0c7f1ea2)

* [OCPBUGS-140550](https://issues.redhat.com/browse/OCPBUGS-140550): Bring upstream changes to 4.19 release branch [#460](https://github.com/openshift/kubernetes-autoscaler/pull/460)
* [OCPBUGS-103756](https://issues.redhat.com/browse/OCPBUGS-103756): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#441](https://github.com/openshift/kubernetes-autoscaler/pull/441)
* [Full changelog](https://github.com/openshift/kubernetes-autoscaler/compare/33b1498504745b15dff672a68f4005e35855cc4e...7243a8cc65c8c0f28290149993e4e6de0c7f1ea2)


### [cluster-autoscaler-operator](https://github.com/openshift/cluster-autoscaler-operator/tree/54bf5566c1b4a0e71f4841c75fb6ca2040e8b956)

* [OCPBUGS-103611](https://issues.redhat.com/browse/OCPBUGS-103611): Bump x/net package in release-4.19 [#385](https://github.com/openshift/cluster-autoscaler-operator/pull/385)
* [Full changelog](https://github.com/openshift/cluster-autoscaler-operator/compare/dd778375334821fb94db695ec1963e2f7f001893...54bf5566c1b4a0e71f4841c75fb6ca2040e8b956)


### [cluster-baremetal-operator](https://github.com/openshift/cluster-baremetal-operator/tree/0ccaf6837c88e52207a4e2cdddbedfe6121ba7b9)

* [OCPBUGS-103620](https://issues.redhat.com/browse/OCPBUGS-103620): Use patched x/net fork v0.43.0-sec.4 [#674](https://github.com/openshift/cluster-baremetal-operator/pull/674)
* [Full changelog](https://github.com/openshift/cluster-baremetal-operator/compare/d25f65138ada818ff264f66e239e856a5e51abed...0ccaf6837c88e52207a4e2cdddbedfe6121ba7b9)


### [cluster-cloud-controller-manager-operator](https://github.com/openshift/cluster-cloud-controller-manager-operator/tree/ad2f84df04da7fe2da718f803069bc67ae4e7374)

* [OCPBUGS-103613](https://issues.redhat.com/browse/OCPBUGS-103613): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#512](https://github.com/openshift/cluster-cloud-controller-manager-operator/pull/512)
* [Full changelog](https://github.com/openshift/cluster-cloud-controller-manager-operator/compare/5b39a4dfc245942db4a21cec493bfb2a15bb4b21...ad2f84df04da7fe2da718f803069bc67ae4e7374)


### [cluster-config-api](https://github.com/openshift/api/tree/3e5cec41451c4adf9642fe6fb80a71c2fd4e6b3c)

* [SPLAT-2868](https://issues.redhat.com/browse/SPLAT-2868): Add vSphere multi vCenter Day 2 [#3110](https://github.com/openshift/api/pull/3110)
* [Full changelog](https://github.com/openshift/api/compare/1ebdd7bba8e6c503a1f61c6d467ed877783826e1...3e5cec41451c4adf9642fe6fb80a71c2fd4e6b3c)


### [cluster-csi-snapshot-controller-operator](https://github.com/openshift/cluster-csi-snapshot-controller-operator/tree/75abb4acc2cf816fc05a3d98bc4a0238deea24d4)

* [OCPBUGS-103626](https://issues.redhat.com/browse/OCPBUGS-103626): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#294](https://github.com/openshift/cluster-csi-snapshot-controller-operator/pull/294)
* [Full changelog](https://github.com/openshift/cluster-csi-snapshot-controller-operator/compare/cf99de974354133f853928cff9e19ad19c5347d9...75abb4acc2cf816fc05a3d98bc4a0238deea24d4)


### [cluster-dns-operator](https://github.com/openshift/cluster-dns-operator/tree/fcc716b3e237afe967c6e01a01a0aa2cc3f9d069)

* [OCPBUGS-103625](https://issues.redhat.com/browse/OCPBUGS-103625): Use patched x/net fork v0.43.0-sec.4 [#496](https://github.com/openshift/cluster-dns-operator/pull/496)
* [Full changelog](https://github.com/openshift/cluster-dns-operator/compare/659813065170f4e52f80b7a29bbab64bfa9aa172...fcc716b3e237afe967c6e01a01a0aa2cc3f9d069)


### [cluster-etcd-operator](https://github.com/openshift/cluster-etcd-operator/tree/23dd2bc93957bc34214aa65a29575b9d7a5ba807)

* [OCPBUGS-103623](https://issues.redhat.com/browse/OCPBUGS-103623): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#1694](https://github.com/openshift/cluster-etcd-operator/pull/1694)
* [Full changelog](https://github.com/openshift/cluster-etcd-operator/compare/024f8af5195a6bdbe0eb7e253ba83b5d3190247f...23dd2bc93957bc34214aa65a29575b9d7a5ba807)


### [cluster-ingress-operator](https://github.com/openshift/cluster-ingress-operator/tree/47d5d36cacb3b2eae377cbd8591d0634363aa76a)

* [OCPBUGS-103610](https://issues.redhat.com/browse/OCPBUGS-103610): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3 [#1570](https://github.com/openshift/cluster-ingress-operator/pull/1570)
* [Full changelog](https://github.com/openshift/cluster-ingress-operator/compare/a3c5d8daff2a53d7e05649a31a233fa1f0cf0977...47d5d36cacb3b2eae377cbd8591d0634363aa76a)


### [cluster-kube-apiserver-operator](https://github.com/openshift/cluster-kube-apiserver-operator/tree/db80a3e83b79045aabd78589d37e17e3548f6a37)

* [OCPBUGS-103624](https://issues.redhat.com/browse/OCPBUGS-103624): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#2298](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2298)
* [OCPBUGS-128389](https://issues.redhat.com/browse/OCPBUGS-128389): Fix kube-apiserver-to-kubelet-signer refresh interval [#2324](https://github.com/openshift/cluster-kube-apiserver-operator/pull/2324)
* [Full changelog](https://github.com/openshift/cluster-kube-apiserver-operator/compare/1b48403438c3e0eb2ccb5cae331f12fe9abe169c...db80a3e83b79045aabd78589d37e17e3548f6a37)


### [cluster-kube-controller-manager-operator](https://github.com/openshift/cluster-kube-controller-manager-operator/tree/a2d1efd88a01dc62807371850d7bef40e6d0d296)

* [OCPBUGS-103621](https://issues.redhat.com/browse/OCPBUGS-103621): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#960](https://github.com/openshift/cluster-kube-controller-manager-operator/pull/960)
* [Full changelog](https://github.com/openshift/cluster-kube-controller-manager-operator/compare/7c4e44698b6004e52c59e03dd0c89611fbbfa999...a2d1efd88a01dc62807371850d7bef40e6d0d296)


### [cluster-kube-scheduler-operator](https://github.com/openshift/cluster-kube-scheduler-operator/tree/ad104c60a68e8a7cee5ba918f8be5ac6895cc51a)

* [OCPBUGS-103608](https://issues.redhat.com/browse/OCPBUGS-103608): [release-4.19]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#668](https://github.com/openshift/cluster-kube-scheduler-operator/pull/668)
* [Full changelog](https://github.com/openshift/cluster-kube-scheduler-operator/compare/bf8cd78f223b3d27ea4fb170d22edea14df26df3...ad104c60a68e8a7cee5ba918f8be5ac6895cc51a)


### [cluster-machine-approver](https://github.com/openshift/cluster-machine-approver/tree/05320882484c28c3c3a320045158ea0acad1f9a8)

* [OCPBUGS-103615](https://issues.redhat.com/browse/OCPBUGS-103615): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#326](https://github.com/openshift/cluster-machine-approver/pull/326)
* [OCPBUGS-135250](https://issues.redhat.com/browse/OCPBUGS-135250): Fix expired test certificate in csr_check_test.go [#349](https://github.com/openshift/cluster-machine-approver/pull/349)
* [Full changelog](https://github.com/openshift/cluster-machine-approver/compare/49517f79bdfeb0fa06f2bc80d793a0c9db194aab...05320882484c28c3c3a320045158ea0acad1f9a8)


### [cluster-monitoring-operator](https://github.com/openshift/cluster-monitoring-operator/tree/f903d3382d39b540c9e40791ec01b041b6d7156a)

* [OCPBUGS-129139](https://issues.redhat.com/browse/OCPBUGS-129139): don't delete admin-owned Alertmanager secrets on destroy [#3141](https://github.com/openshift/cluster-monitoring-operator/pull/3141)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#3107](https://github.com/openshift/cluster-monitoring-operator/pull/3107)
* [OCPBUGS-112575](https://issues.redhat.com/browse/OCPBUGS-112575): [release-4.19] Makefile: version-stamp golangci-lint binary to prevent stale linter [#3067](https://github.com/openshift/cluster-monitoring-operator/pull/3067)
* [OCPBUGS-105310](https://issues.redhat.com/browse/OCPBUGS-105310): [release-4.19] wrap library-go resourceCache with mutex for thread safety [#3042](https://github.com/openshift/cluster-monitoring-operator/pull/3042)
* [OCPBUGS-103627](https://issues.redhat.com/browse/OCPBUGS-103627): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#3073](https://github.com/openshift/cluster-monitoring-operator/pull/3073)
* [OCPBUGS-104539](https://issues.redhat.com/browse/OCPBUGS-104539): Backport e2e stabilization 4.19 [#3029](https://github.com/openshift/cluster-monitoring-operator/pull/3029)
* [OCPBUGS-100373](https://issues.redhat.com/browse/OCPBUGS-100373): [release-4.19] fix: watch cluster wide proxy changes and apply changes accordingly [#3023](https://github.com/openshift/cluster-monitoring-operator/pull/3023)
* [Full changelog](https://github.com/openshift/cluster-monitoring-operator/compare/e5ef6e8bdac2abc6741130d2304565ab5cd8ca78...f903d3382d39b540c9e40791ec01b041b6d7156a)


### [cluster-network-operator](https://github.com/openshift/cluster-network-operator/tree/d0c6f75e06c861c7f2d5355dab0e7bd8a20de43c)

* [OCPBUGS-99750](https://issues.redhat.com/browse/OCPBUGS-99750): Bump github.com/containernetworking/cni v0.8.0 -&gt; v1.3.0 [#3094](https://github.com/openshift/cluster-network-operator/pull/3094)
* [Full changelog](https://github.com/openshift/cluster-network-operator/compare/945b31bdb28f5654dfadba0169185c95588f46b0...d0c6f75e06c861c7f2d5355dab0e7bd8a20de43c)


### [cluster-node-tuning-operator](https://github.com/openshift/cluster-node-tuning-operator/tree/f616e0a2a73b61bff88f1ae7d35fd6ecde13ada7)

* [OCPBUGS-103643](https://issues.redhat.com/browse/OCPBUGS-103643): Bump golang.org/x/net to v0.43.0-sec.3 [#1606](https://github.com/openshift/cluster-node-tuning-operator/pull/1606)
* [OCPBUGS-115119](https://issues.redhat.com/browse/OCPBUGS-115119): Use Add() instead of AddRateLimited() for routine Profile enqueues [#1626](https://github.com/openshift/cluster-node-tuning-operator/pull/1626)
* [Full changelog](https://github.com/openshift/cluster-node-tuning-operator/compare/f7ed3c80209e2aa5f66dced81b265a3868b70e2c...f616e0a2a73b61bff88f1ae7d35fd6ecde13ada7)


### [cluster-olm-operator](https://github.com/openshift/cluster-olm-operator/tree/aa0042cecd2f59beed47bc0a99190038acd4ca00)

* [OCPBUGS-103637](https://issues.redhat.com/browse/OCPBUGS-103637): bump golang.org/x/net to v0.43.0-sec.3 to fix CVE-2026-33814 [#244](https://github.com/openshift/cluster-olm-operator/pull/244)
* [Full changelog](https://github.com/openshift/cluster-olm-operator/compare/88faec2c2449f9f4ed3cfc4b8893cc29e6bfbbf3...aa0042cecd2f59beed47bc0a99190038acd4ca00)


### [cluster-policy-controller](https://github.com/openshift/cluster-policy-controller/tree/d742072842859f9db567e8a69a0ba04a32c1458e)

* [OCPBUGS-103639](https://issues.redhat.com/browse/OCPBUGS-103639): Bump golang.org/x/net to v0.43.0-sec.3 [#201](https://github.com/openshift/cluster-policy-controller/pull/201)
* [Full changelog](https://github.com/openshift/cluster-policy-controller/compare/d1ea75b45228a6af17f3a1899ab4bd214e28f54b...d742072842859f9db567e8a69a0ba04a32c1458e)


### [cluster-samples-operator](https://github.com/openshift/cluster-samples-operator/tree/598dcab47d75d3dc77b210bea1e6b85d10d8b3e2)

* [OCPBUGS-103636](https://issues.redhat.com/browse/OCPBUGS-103636): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#719](https://github.com/openshift/cluster-samples-operator/pull/719)
* [OCPBUGS-129481](https://issues.redhat.com/browse/OCPBUGS-129481): Restrict samples operator access to the global pull-secret [#730](https://github.com/openshift/cluster-samples-operator/pull/730)
* [Full changelog](https://github.com/openshift/cluster-samples-operator/compare/aa7f05d27fb2a60314278f0c248fd961442a4144...598dcab47d75d3dc77b210bea1e6b85d10d8b3e2)


### [cluster-storage-operator](https://github.com/openshift/cluster-storage-operator/tree/1f6e0a9a7460d400fc7a8d0aff94739c64040daa)

* [OCPBUGS-103630](https://issues.redhat.com/browse/OCPBUGS-103630): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#736](https://github.com/openshift/cluster-storage-operator/pull/736)
* [Full changelog](https://github.com/openshift/cluster-storage-operator/compare/17d139ee754b3fadec3e5130cc868e8f281a6e1e...1f6e0a9a7460d400fc7a8d0aff94739c64040daa)


### [cluster-version-operator](https://github.com/openshift/cluster-version-operator/tree/ea7bd42ee4f7a5d4774c0c0b3b0ce31940a9cf38)

* [OCPBUGS-103642](https://issues.redhat.com/browse/OCPBUGS-103642): Bump golang.org/x/net to v0.43.0-sec.3 [#1458](https://github.com/openshift/cluster-version-operator/pull/1458)
* [Full changelog](https://github.com/openshift/cluster-version-operator/compare/842a2ac2261e03bc5b6717620c076bf58652c1f6...ea7bd42ee4f7a5d4774c0c0b3b0ce31940a9cf38)


### [console](https://github.com/openshift/console/tree/8bcbe07d37cdf28d7c7cba0ba3dbff7a2dffc5b6)

* [OCPBUGS-83496](https://issues.redhat.com/browse/OCPBUGS-83496): remove dev to admin links as dev monitoring views are enabled [#16174](https://github.com/openshift/console/pull/16174)
* [OCPBUGS-83496](https://issues.redhat.com/browse/OCPBUGS-83496): Temporarily skip the flaky Data Grid installation spec [#17354](https://github.com/openshift/console/pull/17354)
* [OCPBUGS-128641](https://issues.redhat.com/browse/OCPBUGS-128641): Wait for demo plugin deployment readiness [#17332](https://github.com/openshift/console/pull/17332)
* [OCPBUGS-111706](https://issues.redhat.com/browse/OCPBUGS-111706): Re-enable Knative Cypress e2e tests [#16906](https://github.com/openshift/console/pull/16906)
* [OCPBUGS-122013](https://issues.redhat.com/browse/OCPBUGS-122013): Validate chart URL in /api/helm/verify [#17154](https://github.com/openshift/console/pull/17154)
* Fix for OCPBUGS-92079: CVE-2026-44990 [#16716](https://github.com/openshift/console/pull/16716)
* [OCPBUGS-112275](https://issues.redhat.com/browse/OCPBUGS-112275): Fix flaky TestAsyncCache backend test [#17048](https://github.com/openshift/console/pull/17048)
* Fix OCPBUGS-98765: CVE-2026-48801 [#16855](https://github.com/openshift/console/pull/16855)
* [OCPBUGS-100516](https://issues.redhat.com/browse/OCPBUGS-100516), [OCPBUGS-101792](https://issues.redhat.com/browse/OCPBUGS-101792): Fix CVE-2026-69153 and CVE-2026-45623 - Bump postcss [#17057](https://github.com/openshift/console/pull/17057)
* [OCPBUGS-98428](https://issues.redhat.com/browse/OCPBUGS-98428): [release-4.19] CVE-2026-59869 bump js-yaml [#17007](https://github.com/openshift/console/pull/17007)
* [OCPBUGS-109139](https://issues.redhat.com/browse/OCPBUGS-109139): Fix leading whitespace in Quick Start execute code snippets [#17004](https://github.com/openshift/console/pull/17004)
* [OCPBUGS-100182](https://issues.redhat.com/browse/OCPBUGS-100182): fix trailing quote in prometheus query [#16884](https://github.com/openshift/console/pull/16884)
* [OCPBUGS-100068](https://issues.redhat.com/browse/OCPBUGS-100068): quickstart page i18n misses (Fix Quick Starts i18n bundle lookup for zh-CN)- #16869 [#16871](https://github.com/openshift/console/pull/16871)
* [OCPBUGS-86751](https://issues.redhat.com/browse/OCPBUGS-86751), [OCPBUGS-87083](https://issues.redhat.com/browse/OCPBUGS-87083), [OCPBUGS-88750](https://issues.redhat.com/browse/OCPBUGS-88750): [release-4.19] bump package: webpack-dev-server, protobufjs, fast-uri [#16727](https://github.com/openshift/console/pull/16727)
* [Full changelog](https://github.com/openshift/console/compare/bf7f4e9e624e74e85d20e985aaba3793b7803893...8bcbe07d37cdf28d7c7cba0ba3dbff7a2dffc5b6)


### [console-operator](https://github.com/openshift/console-operator/tree/45c535c7efb115b1bc4d5e0156e884b451f02672)

* [OCPBUGS-103631](https://issues.redhat.com/browse/OCPBUGS-103631): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#1222](https://github.com/openshift/console-operator/pull/1222)
* [NETOBSERV-2296](https://issues.redhat.com/browse/NETOBSERV-2296): add missing annotations on netobserv quickstart [#1094](https://github.com/openshift/console-operator/pull/1094)
* [Full changelog](https://github.com/openshift/console-operator/compare/0eb1db361b7d4187721d25ba6c74997076b3937b...45c535c7efb115b1bc4d5e0156e884b451f02672)


### [coredns](https://github.com/openshift/coredns/tree/b3ea702f351e71c2aedf5d8ff2a8debe7f1c4e5e)

* [OCPBUGS-103640](https://issues.redhat.com/browse/OCPBUGS-103640): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#204](https://github.com/openshift/coredns/pull/204)
* [Full changelog](https://github.com/openshift/coredns/compare/4f64931403bf747b78bccb40ad877b08da534e23...b3ea702f351e71c2aedf5d8ff2a8debe7f1c4e5e)


### [csi-driver-manila, openstack-cinder-csi-driver, openstack-cloud-controller-manager](https://github.com/openshift/cloud-provider-openstack/tree/10bc8b6d5dcf160e19e54e041ae8aa8dc01c0d03)

* [OCPBUGS-103724](https://issues.redhat.com/browse/OCPBUGS-103724), [OCPBUGS-103725](https://issues.redhat.com/browse/OCPBUGS-103725): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#423](https://github.com/openshift/cloud-provider-openstack/pull/423)
* [Full changelog](https://github.com/openshift/cloud-provider-openstack/compare/cad695482eba6c96c5ab52e6c71188f44f85646f...10bc8b6d5dcf160e19e54e041ae8aa8dc01c0d03)


### [csi-driver-nfs](https://github.com/openshift/csi-driver-nfs/tree/f604d3542c65ba79c0980a335d6db9cbac7e32d1)

* [OCPBUGS-82805](https://issues.redhat.com/browse/OCPBUGS-82805): Bump github.com/moby/spdystream@v0.5.1 [#193](https://github.com/openshift/csi-driver-nfs/pull/193)
* [Full changelog](https://github.com/openshift/csi-driver-nfs/compare/e85a428308f5e21a1b74b59eb29e52dbba931841...f604d3542c65ba79c0980a335d6db9cbac7e32d1)


### [csi-external-attacher](https://github.com/openshift/csi-external-attacher/tree/839536a03f5a2f337ec09090283468a6e2d5cd11)

* UPSTREAM: 110: OCPBUGS-103651: Bump golang.org/x/net to v0.43.0-sec.4 [#114](https://github.com/openshift/csi-external-attacher/pull/114)
* [Full changelog](https://github.com/openshift/csi-external-attacher/compare/4c8a8a5dbf081c2e1ae992cbfa7f419ca5850f0b...839536a03f5a2f337ec09090283468a6e2d5cd11)


### [csi-external-provisioner](https://github.com/openshift/csi-external-provisioner/tree/37814acaa4dd92def6b71dcf9f090b54a796bf3e)

* [OCPBUGS-92905](https://issues.redhat.com/browse/OCPBUGS-92905): Replace golang.org/x/crypto with github.com/openshift-sustaining/crypto@v0.41.0-sec.4 to address CVE-2026-46597 [#161](https://github.com/openshift/csi-external-provisioner/pull/161)
* [Full changelog](https://github.com/openshift/csi-external-provisioner/compare/34ed6f82e8789bd26dbd4399d7833e3d09b56173...37814acaa4dd92def6b71dcf9f090b54a796bf3e)


### [csi-external-resizer](https://github.com/openshift/csi-external-resizer/tree/b91b0d999bf775948c50a3416e7d7c26866cf2e8)

* [OCPBUGS-103650](https://issues.redhat.com/browse/OCPBUGS-103650): Bump golang.org/x/net to v0.43.0-sec.4 [#212](https://github.com/openshift/csi-external-resizer/pull/212)
* [OCPBUGS-80437](https://issues.redhat.com/browse/OCPBUGS-80437): Patching google.golang.org/grpc to v1.75.1 [#202](https://github.com/openshift/csi-external-resizer/pull/202)
* [Full changelog](https://github.com/openshift/csi-external-resizer/compare/ac275c3a81edcc4edf23aecf8974c9c23f2aaea9...b91b0d999bf775948c50a3416e7d7c26866cf2e8)


### [csi-external-snapshotter, csi-snapshot-controller](https://github.com/openshift/csi-external-snapshotter/tree/83a5d68520a603b42dc199e5b39a7bf6cf66622d)

* [OCPBUGS-127500](https://issues.redhat.com/browse/OCPBUGS-127500): [release-4.19] OCPBUGS-92084: UPSTREAM: 1392: Fix VolumeSnapshotContent deletion [#256](https://github.com/openshift/csi-external-snapshotter/pull/256)
* [OCPBUGS-103648](https://issues.redhat.com/browse/OCPBUGS-103648): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.43.0-sec.3 [#237](https://github.com/openshift/csi-external-snapshotter/pull/237)
* [Full changelog](https://github.com/openshift/csi-external-snapshotter/compare/8a319b5b9df2d4f596b4619f73cf5a65eab031c1...83a5d68520a603b42dc199e5b39a7bf6cf66622d)


### [csi-livenessprobe](https://github.com/openshift/csi-livenessprobe/tree/768077d4aa5989d9fc2430ab2e567314c07dc24e)

* [OCPBUGS-103653](https://issues.redhat.com/browse/OCPBUGS-103653): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#102](https://github.com/openshift/csi-livenessprobe/pull/102)
* [Full changelog](https://github.com/openshift/csi-livenessprobe/compare/ca5144785b2c8caa6fe0ffcf7837e8e17b4864fb...768077d4aa5989d9fc2430ab2e567314c07dc24e)


### [docker-builder](https://github.com/openshift/builder/tree/aee5284dce8e4134b27c32258d56aa13e34c7fe6)

* [OCPBUGS-89948](https://issues.redhat.com/browse/OCPBUGS-89948), [OCPBUGS-90373](https://issues.redhat.com/browse/OCPBUGS-90373), [OCPBUGS-92448](https://issues.redhat.com/browse/OCPBUGS-92448), [OCPBUGS-92619](https://issues.redhat.com/browse/OCPBUGS-92619), [OCPBUGS-92917](https://issues.redhat.com/browse/OCPBUGS-92917): Bump golang.org/x/crypto to fix CVE-2025-22869,CVE-2025-47913,CVE-2026-46597,CVE-2026-39829,CVE-2026-39832 [#552](https://github.com/openshift/builder/pull/552)
* [Full changelog](https://github.com/openshift/builder/compare/35d2a5fcfb1f791d9da6d6e0dc1de9723d773891...aee5284dce8e4134b27c32258d56aa13e34c7fe6)


### [docker-registry](https://github.com/openshift/image-registry/tree/8cbe7286f3bb1ceec33c6cb0acd265d441e032ed)

* [OCPBUGS-103654](https://issues.redhat.com/browse/OCPBUGS-103654): [relese-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#479](https://github.com/openshift/image-registry/pull/479)
* [Full changelog](https://github.com/openshift/image-registry/compare/53c4fd9d7448c1bad07cb45abfb47b25046deedc...8cbe7286f3bb1ceec33c6cb0acd265d441e032ed)


### [gcp-cloud-controller-manager](https://github.com/openshift/cloud-provider-gcp/tree/48ec8106d0559200b96533fca34449c4db78e0de)

* [OCPBUGS-103668](https://issues.redhat.com/browse/OCPBUGS-103668), [OCPBUGS-103773](https://issues.redhat.com/browse/OCPBUGS-103773), [OCPBUGS-88240](https://issues.redhat.com/browse/OCPBUGS-88240): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 [#169](https://github.com/openshift/cloud-provider-gcp/pull/169)
* [Full changelog](https://github.com/openshift/cloud-provider-gcp/compare/d8d3aeba536f4c9f6593a08045466f06dc7406ff...48ec8106d0559200b96533fca34449c4db78e0de)


### [gcp-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-gcp/tree/d2103eabd77f742a53be0014f09a4e85b7ba8819)

* [OCPBUGS-103665](https://issues.redhat.com/browse/OCPBUGS-103665): Bump golang.org/x/net to github.com/openshift-sustaining/net v0.43.0-sec.4 CVE-2026-33814 [release-4.19] [#319](https://github.com/openshift/cluster-api-provider-gcp/pull/319)
* [Full changelog](https://github.com/openshift/cluster-api-provider-gcp/compare/cc42384fe0834f4d1711bc4e2794fab2886f292f...d2103eabd77f742a53be0014f09a4e85b7ba8819)


### [gcp-machine-controllers](https://github.com/openshift/machine-api-provider-gcp/tree/b0d2342531b789d9ba4b219549da783678a89500)

* [OCPBUGS-103685](https://issues.redhat.com/browse/OCPBUGS-103685): Bump golang.org/x/net to v0.43.0-sec.3 [#188](https://github.com/openshift/machine-api-provider-gcp/pull/188)
* [Full changelog](https://github.com/openshift/machine-api-provider-gcp/compare/d4bcb42cde235fd104ce5e1937618a0d3c44dea0...b0d2342531b789d9ba4b219549da783678a89500)


### [gcp-pd-csi-driver](https://github.com/openshift/gcp-pd-csi-driver/tree/ea80089141a9377513ed15286b2f19744afe4a55)

* [OCPBUGS-103660](https://issues.redhat.com/browse/OCPBUGS-103660): CVE-2026-33814: replace golang.org/x/net with openshift-sustaining fork [#146](https://github.com/openshift/gcp-pd-csi-driver/pull/146)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver/compare/68f780b93df28977b0f0569814b14d7db2500edb...ea80089141a9377513ed15286b2f19744afe4a55)


### [gcp-pd-csi-driver-operator](https://github.com/openshift/gcp-pd-csi-driver-operator/tree/db5ab16bd1353e1b57177a8ed66b078093404c0b)

* [OCPBUGS-103664](https://issues.redhat.com/browse/OCPBUGS-103664): Use patched x/net fork v0.43.0-sec.4 [#219](https://github.com/openshift/gcp-pd-csi-driver-operator/pull/219)
* [Full changelog](https://github.com/openshift/gcp-pd-csi-driver-operator/compare/19962336d00de10a9e173dbae33973a1abcaeb3f...db5ab16bd1353e1b57177a8ed66b078093404c0b)


### [gcp-workload-identity-federation-webhook](https://github.com/openshift/gcp-workload-identity-federation-webhook/tree/eef6880a796e8751aa2365ab63024fcc56b82ccf)

* [OCPBUGS-103670](https://issues.redhat.com/browse/OCPBUGS-103670): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 [#25](https://github.com/openshift/gcp-workload-identity-federation-webhook/pull/25)
* [Full changelog](https://github.com/openshift/gcp-workload-identity-federation-webhook/compare/fbf4c1b2b233806f8233b89abca2795a4cadef14...eef6880a796e8751aa2365ab63024fcc56b82ccf)


### [haproxy-router](https://github.com/openshift/router/tree/f0d97a0ddaccf153648fee10067bdd146aa00c77)

* [OCPBUGS-86727](https://issues.redhat.com/browse/OCPBUGS-86727): Prevent SSRF via FQDN-typed EndpointSlices [#820](https://github.com/openshift/router/pull/820)
* [Full changelog](https://github.com/openshift/router/compare/2ea2a16ff8a5f25e4212bee0a5206dc8aa697534...f0d97a0ddaccf153648fee10067bdd146aa00c77)


### [hypershift](https://github.com/openshift/hypershift/tree/ae43771035aca24d6b0be520e77f28a3563cfca9)

* Sync approver aliases with main for release-4.19 [#10191](https://github.com/openshift/hypershift/pull/10191)
* [ACM-45149](https://issues.redhat.com/browse/ACM-45149): Migrate Go builder for hypershift-cli, hypershift-release [#10069](https://github.com/openshift/hypershift/pull/10069)
* [OCPBUGS-92924](https://issues.redhat.com/browse/OCPBUGS-92924): CVE-2026-46597 openshift4/ose-hypershift-rhel9: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs [openshift-4.19] [#9274](https://github.com/openshift/hypershift/pull/9274)
* [OCPBUGS-120749](https://issues.redhat.com/browse/OCPBUGS-120749): update Containerfile.cli runtime base image to floating tag [release-4.19] [#9559](https://github.com/openshift/hypershift/pull/9559)
* [OCPBUGS-76287](https://issues.redhat.com/browse/OCPBUGS-76287): CVE-2025-52881 openshift/hypershift multicluster-engine/hypershift-rhel9-operator: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [mce-2.9] [#8282](https://github.com/openshift/hypershift/pull/8282)
* [Full changelog](https://github.com/openshift/hypershift/compare/513432298d58160933165042456e543ace99b66b...ae43771035aca24d6b0be520e77f28a3563cfca9)


### [ibm-cloud-controller-manager](https://github.com/openshift/cloud-provider-ibm/tree/b916c603eadf504f816303640cf763b59e30266b)

* [OCPBUGS-120698](https://issues.redhat.com/browse/OCPBUGS-120698): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#113](https://github.com/openshift/cloud-provider-ibm/pull/113)
* [Full changelog](https://github.com/openshift/cloud-provider-ibm/compare/7422aab27110768d8604539b9bb01ca329ff70b7...b916c603eadf504f816303640cf763b59e30266b)


### [ibm-vpc-block-csi-driver](https://github.com/openshift/ibm-vpc-block-csi-driver/tree/6f0e95cb921029fed7f48d92dae3c38999b9918e)

* [OCPBUGS-103679](https://issues.redhat.com/browse/OCPBUGS-103679): Use patched x/net fork v0.43.0-sec.4 [#166](https://github.com/openshift/ibm-vpc-block-csi-driver/pull/166)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver/compare/7923f6c19410d90324a22e34b7eb7ee2dae8197c...6f0e95cb921029fed7f48d92dae3c38999b9918e)


### [ibm-vpc-block-csi-driver-operator](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/tree/b00f472da1ed8f361bfa7ff994e411d87ef636f6)

* [OCPBUGS-103677](https://issues.redhat.com/browse/OCPBUGS-103677): Use patched x/net fork v0.43.0-sec.4 [#190](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/pull/190)
* [Full changelog](https://github.com/openshift/ibm-vpc-block-csi-driver-operator/compare/3dfcfa12e31bccd7c43018e1324a391b0bc03244...b00f472da1ed8f361bfa7ff994e411d87ef636f6)


### [ibmcloud-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-ibmcloud/tree/9878e8a46b85f6508df64e1dca7f61e991177502)

* [OCPBUGS-103676](https://issues.redhat.com/browse/OCPBUGS-103676): Replace golang.org/x/net with openshift-sustaining/net [#173](https://github.com/openshift/cluster-api-provider-ibmcloud/pull/173)
* [Full changelog](https://github.com/openshift/cluster-api-provider-ibmcloud/compare/940ac1c27e5548f738219b8c2ea4d1b6924e60e5...9878e8a46b85f6508df64e1dca7f61e991177502)


### [ibmcloud-machine-controllers](https://github.com/openshift/machine-api-provider-ibmcloud/tree/301c962bf0ad72233aaaf4c5df3ec5c559c142b6)

* [OCPBUGS-103680](https://issues.redhat.com/browse/OCPBUGS-103680): replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 [#103](https://github.com/openshift/machine-api-provider-ibmcloud/pull/103)
* [Full changelog](https://github.com/openshift/machine-api-provider-ibmcloud/compare/bdbc75c1786a8a58e7d1a9c24db95e6a5a334266...301c962bf0ad72233aaaf4c5df3ec5c559c142b6)


### [insights-operator](https://github.com/openshift/insights-operator/tree/ad827886f3dc7052dcc880a0b1af44d8be8a2cff)

* [OCPBUGS-103682](https://issues.redhat.com/browse/OCPBUGS-103682): Bump golang.org/x/net to v0.43.0-sec.3 [#1354](https://github.com/openshift/insights-operator/pull/1354)
* [OCPBUGS-112750](https://issues.redhat.com/browse/OCPBUGS-112750): secrets and configmap revisions count gathering [#1350](https://github.com/openshift/insights-operator/pull/1350)
* [OCPBUGS-105424](https://issues.redhat.com/browse/OCPBUGS-105424): Fix indentation bug on livenessProbe [#1340](https://github.com/openshift/insights-operator/pull/1340)
* [OCPBUGS-99987](https://issues.redhat.com/browse/OCPBUGS-99987): update HyperShift deployment manifest [#1328](https://github.com/openshift/insights-operator/pull/1328)
* [Full changelog](https://github.com/openshift/insights-operator/compare/28e011b6e9e3dc7c66b8f6403abda2339ef0725c...ad827886f3dc7052dcc880a0b1af44d8be8a2cff)


### [ironic](https://github.com/openshift/ironic-image/tree/bf69786af61add2098597da5a14d3da1991d3798)

* [OCPBUGS-88476](https://issues.redhat.com/browse/OCPBUGS-88476): Updating openstack-ironic commit that fixes CVE-2026-43003 [#896](https://github.com/openshift/ironic-image/pull/896)
* [OCPBUGS-100165](https://issues.redhat.com/browse/OCPBUGS-100165): Update openstack-ironic commit hash for CVE-2026-44918 [#882](https://github.com/openshift/ironic-image/pull/882)
* [Full changelog](https://github.com/openshift/ironic-image/compare/28707d95dfeb0dbd81089a9feb9dc16d8df7a824...bf69786af61add2098597da5a14d3da1991d3798)


### [ironic-agent](https://github.com/openshift/ironic-agent-image/tree/9a24b3300c400fae2e35c1958f45c189bc394ad4)

* [OCPBUGS-99885](https://issues.redhat.com/browse/OCPBUGS-99885): Bump ironic-python-agent pinned commit for CVE-2026-66138 [#307](https://github.com/openshift/ironic-agent-image/pull/307)
* [OCPBUGS-88476](https://issues.redhat.com/browse/OCPBUGS-88476): Update ironic-python-agent commit that fixes CVE-2026-43003 [#304](https://github.com/openshift/ironic-agent-image/pull/304)
* [Full changelog](https://github.com/openshift/ironic-agent-image/compare/93cb0c2763ae37db868038423a4eda6431dbcc13...9a24b3300c400fae2e35c1958f45c189bc394ad4)


### [kube-metrics-server](https://github.com/openshift/kubernetes-metrics-server/tree/a20f305638fa4c06b9a1e6a99458fd180d3b83d7)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#84](https://github.com/openshift/kubernetes-metrics-server/pull/84)
* [Full changelog](https://github.com/openshift/kubernetes-metrics-server/compare/d482dffae6a16460fc34ddd896d1d8cef3af50bd...a20f305638fa4c06b9a1e6a99458fd180d3b83d7)


### [kube-state-metrics](https://github.com/openshift/kube-state-metrics/tree/bf0616bca792deb7ac1c569b84bb12a0fc9031e9)

* [OCPBUGS-103674](https://issues.redhat.com/browse/OCPBUGS-103674): Use patched x/net fork v0.43.0-sec.4 [#165](https://github.com/openshift/kube-state-metrics/pull/165)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#193](https://github.com/openshift/kube-state-metrics/pull/193)
* [Full changelog](https://github.com/openshift/kube-state-metrics/compare/ea8b50c5554ce2ce56ec925d67791e5ed655957c...bf0616bca792deb7ac1c569b84bb12a0fc9031e9)


### [kubevirt-cloud-controller-manager](https://github.com/openshift/cloud-provider-kubevirt/tree/f0ff269ad70900ec841e2e47a9d92e6703bc6539)

* [OCPBUGS-78392](https://issues.redhat.com/browse/OCPBUGS-78392): Updating ose-kubevirt-cloud-controller-manager-container image to be consistent with ART for 4.19 [#63](https://github.com/openshift/cloud-provider-kubevirt/pull/63)
* [OCPBUGS-78392](https://issues.redhat.com/browse/OCPBUGS-78392): Regenerate go.sum to fix verify-deps [#85](https://github.com/openshift/cloud-provider-kubevirt/pull/85)
* [Full changelog](https://github.com/openshift/cloud-provider-kubevirt/compare/5d2bf5ed318f31a2b7890e948dd1da85caff99df...f0ff269ad70900ec841e2e47a9d92e6703bc6539)


### [machine-api-operator](https://github.com/openshift/machine-api-operator/tree/ac319ca48579f088890de554bdd7fdf8235d07c0)

* [OCPBUGS-103684](https://issues.redhat.com/browse/OCPBUGS-103684): replace golang.org/x/net with openshift-sustaining/net@v0.43.0-sec.4 [#1544](https://github.com/openshift/machine-api-operator/pull/1544)
* [Full changelog](https://github.com/openshift/machine-api-operator/compare/d89af39e4ddb9b0a89d400664cb496e505e71991...ac319ca48579f088890de554bdd7fdf8235d07c0)


### [machine-config-operator](https://github.com/openshift/machine-config-operator/tree/5c4da8ee05faad19b411f88da73512fb841db86a)

* [OCPBUGS-138574](https://issues.redhat.com/browse/OCPBUGS-138574): Update AMI Whitelist [#6734](https://github.com/openshift/machine-config-operator/pull/6734)
* [OCPBUGS-134664](https://issues.redhat.com/browse/OCPBUGS-134664): Split wait-for-ipsec-connect into two services to avoid ipsec restart [#6692](https://github.com/openshift/machine-config-operator/pull/6692)
* [OCPBUGS-103699](https://issues.redhat.com/browse/OCPBUGS-103699): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#6506](https://github.com/openshift/machine-config-operator/pull/6506)
* [OCPBUGS-128824](https://issues.redhat.com/browse/OCPBUGS-128824): [Release-4.19] Degraded MCP as generated-kubelet is generated with an old controller version [#6612](https://github.com/openshift/machine-config-operator/pull/6612)
* [OCPBUGS-122228](https://issues.redhat.com/browse/OCPBUGS-122228): Update message for MachineOSBuildFailed condition [#6527](https://github.com/openshift/machine-config-operator/pull/6527)
* [OCPBUGS-120741](https://issues.redhat.com/browse/OCPBUGS-120741): [manual cherry-pick of #6446] Use kubernetes scheme in drain controller event recorder [#6499](https://github.com/openshift/machine-config-operator/pull/6499)
* [OCPBUGS-116942](https://issues.redhat.com/browse/OCPBUGS-116942): Update AMI Whitelist [#6488](https://github.com/openshift/machine-config-operator/pull/6488)
* [OCPBUGS-105427](https://issues.redhat.com/browse/OCPBUGS-105427): Replace wildcard permissions with explicit verbs and resources in MCC ClusterRole [#6384](https://github.com/openshift/machine-config-operator/pull/6384)
* [OCPBUGS-105216](https://issues.redhat.com/browse/OCPBUGS-105216): Update AMI Whitelist [#6378](https://github.com/openshift/machine-config-operator/pull/6378)
* [Full changelog](https://github.com/openshift/machine-config-operator/compare/9c5e8342612374f653853791f5fadab2db8bed9d...5c4da8ee05faad19b411f88da73512fb841db86a)


### [machine-image-customization-controller](https://github.com/openshift/image-customization-controller/tree/346df973c99aaba561f1cc5c84e8d1db17fe3152)

* [OCPBUGS-103675](https://issues.redhat.com/browse/OCPBUGS-103675): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#198](https://github.com/openshift/image-customization-controller/pull/198)
* [Full changelog](https://github.com/openshift/image-customization-controller/compare/6d34fbab6ca22e74eb1761278f05d28c42518d8a...346df973c99aaba561f1cc5c84e8d1db17fe3152)


### [monitoring-plugin](https://github.com/openshift/monitoring-plugin/tree/349cdfc41a54ddc6215085da1963af182d7be1cf)

* [OU-1589](https://issues.redhat.com/browse/OU-1589): [release-4.19] sanitize linkified URLs in alert annotations [#1379](https://github.com/openshift/monitoring-plugin/pull/1379)
* [OCPBUGS-132024](https://issues.redhat.com/browse/OCPBUGS-132024): Updating monitoring-plugin-container image to be consistent with ART for 4.19 [#1363](https://github.com/openshift/monitoring-plugin/pull/1363)
* [OCPBUGS-130731](https://issues.redhat.com/browse/OCPBUGS-130731): escape regex variable values in regex matcher contexts [#1357](https://github.com/openshift/monitoring-plugin/pull/1357)
* [OCPBUGS-118234](https://issues.redhat.com/browse/OCPBUGS-118234): [release-4.19] Bump fast-uri to 3.1.7 to fix CVE-2026-84292 [#1335](https://github.com/openshift/monitoring-plugin/pull/1335)
* [OU-1392](https://issues.redhat.com/browse/OU-1392): [release-4.19] fix: parse datetime ranges from the specified format rather than browser specific apis- #1352 [#1354](https://github.com/openshift/monitoring-plugin/pull/1354)
* [OU-1528](https://issues.redhat.com/browse/OU-1528): [release-4.19] Optimize namespace changes in Alerts [#1309](https://github.com/openshift/monitoring-plugin/pull/1309)
* [OCPBUGS-103703](https://issues.redhat.com/browse/OCPBUGS-103703): CVE-2026-33814-4-19 openshift4/ose-monitoring-plugin-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.19] [#1216](https://github.com/openshift/monitoring-plugin/pull/1216)
* NO-JIRA: [release-4.19] Sanitize alert runbook URLs [#1291](https://github.com/openshift/monitoring-plugin/pull/1291)
* [OCPBUGS-98783](https://issues.redhat.com/browse/OCPBUGS-98783): [release-4.19] replace outdated react-linkify dependency [#1167](https://github.com/openshift/monitoring-plugin/pull/1167)
* Fix for OCPBUGS-89704: CVE-2026-12143 [#1152](https://github.com/openshift/monitoring-plugin/pull/1152)
* [OCPBUGS-99026](https://issues.redhat.com/browse/OCPBUGS-99026): Fix CVE-2026-49978 - bump DOMPurify to &gt;= 3.4.7 [#1088](https://github.com/openshift/monitoring-plugin/pull/1088)
* [Full changelog](https://github.com/openshift/monitoring-plugin/compare/bdf74804fac44f2657e3cb11e5b8738fa0767955...349cdfc41a54ddc6215085da1963af182d7be1cf)


### [multus-admission-controller](https://github.com/openshift/multus-admission-controller/tree/6b99f73434be96d97e631872537d75cd3150136d)

* [OCPBUGS-103694](https://issues.redhat.com/browse/OCPBUGS-103694): bump golang.org/x/net to v0.35.0-sec.3 to fix CVE-2026-33814 [#133](https://github.com/openshift/multus-admission-controller/pull/133)
* [Full changelog](https://github.com/openshift/multus-admission-controller/compare/381c36baaad8e45ba10cca43aeeaf00dfc907462...6b99f73434be96d97e631872537d75cd3150136d)


### [multus-cni, multus-cni-microshift](https://github.com/openshift/multus-cni/tree/bea995092ab1fa875fa237a06f4eaa60a7bb2c90)

* [OCPBUGS-103706](https://issues.redhat.com/browse/OCPBUGS-103706), [OCPBUGS-103709](https://issues.redhat.com/browse/OCPBUGS-103709): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame- #355 [#356](https://github.com/openshift/multus-cni/pull/356)
* [Full changelog](https://github.com/openshift/multus-cni/compare/096dd40376213f75c34fee9b1b56ed3693c288d5...bea995092ab1fa875fa237a06f4eaa60a7bb2c90)


### [multus-networkpolicy](https://github.com/openshift/multus-networkpolicy/tree/05f9f3f8a232e3cec17a9e41063e64a96752890c)

* [OCPBUGS-103708](https://issues.redhat.com/browse/OCPBUGS-103708): [release-4.19]  Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#127](https://github.com/openshift/multus-networkpolicy/pull/127)
* [Full changelog](https://github.com/openshift/multus-networkpolicy/compare/0451c87778f69356a705e79a9575b1e61c80f09c...05f9f3f8a232e3cec17a9e41063e64a96752890c)


### [multus-whereabouts-ipam-cni](https://github.com/openshift/whereabouts-cni/tree/5df45eba3930ce3d77ce61e86c23d8c84e989e3e)

* [OCPBUGS-103697](https://issues.redhat.com/browse/OCPBUGS-103697): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#425](https://github.com/openshift/whereabouts-cni/pull/425)
* [Full changelog](https://github.com/openshift/whereabouts-cni/compare/0e1112cea12c707a93bd01d408c598dd070c8676...5df45eba3930ce3d77ce61e86c23d8c84e989e3e)


### [network-metrics-daemon](https://github.com/openshift/network-metrics-daemon/tree/a54952687391e32b8ddd2e9fa5c2eb765feac6b2)

* [OCPBUGS-103710](https://issues.redhat.com/browse/OCPBUGS-103710): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.3 [#152](https://github.com/openshift/network-metrics-daemon/pull/152)
* [Full changelog](https://github.com/openshift/network-metrics-daemon/compare/89e4882698653fdd80fcee2e9d92e668cb02d2d1...a54952687391e32b8ddd2e9fa5c2eb765feac6b2)


### [networking-console-plugin](https://github.com/openshift/networking-console-plugin/tree/78539ca37fe487a44b1f83ad1286ddb2600539d9)

* maintenance: Bump the npm group with 45 updates [#678](https://github.com/openshift/networking-console-plugin/pull/678)
* maintenance: Bump the npm group with 70 updates [#662](https://github.com/openshift/networking-console-plugin/pull/662)
* [OCPNETUI-168](https://issues.redhat.com/browse/OCPNETUI-168): Update Owners file [#648](https://github.com/openshift/networking-console-plugin/pull/648)
* [OCPNETUI-179](https://issues.redhat.com/browse/OCPNETUI-179): migrate to @kubevirt-ui-ext/kubevirt-api [#594](https://github.com/openshift/networking-console-plugin/pull/594)
* maintenance: Bump the npm group with 20 updates [#637](https://github.com/openshift/networking-console-plugin/pull/637)
* maintenance: Bump the npm group with 24 updates [#624](https://github.com/openshift/networking-console-plugin/pull/624)
* [OCPNETUI-184](https://issues.redhat.com/browse/OCPNETUI-184): Sync Dockerfile with Dockerfile.art [#615](https://github.com/openshift/networking-console-plugin/pull/615)
* maintenance: Bump the npm group with 20 updates [#600](https://github.com/openshift/networking-console-plugin/pull/600)
* [OCPNETUI-158](https://issues.redhat.com/browse/OCPNETUI-158): dependency cleanup [#588](https://github.com/openshift/networking-console-plugin/pull/588)
* [OCPNETUI-158](https://issues.redhat.com/browse/OCPNETUI-158): reassign dev and prod dependencies [#587](https://github.com/openshift/networking-console-plugin/pull/587)
* maintenance: Bump the npm group with 23 updates [#573](https://github.com/openshift/networking-console-plugin/pull/573)
* maintenance: Bump the npm group across 1 directory with 24 updates [#570](https://github.com/openshift/networking-console-plugin/pull/570)
* [OCPNETUI-158](https://issues.redhat.com/browse/OCPNETUI-158): Align shared modules with Console [#568](https://github.com/openshift/networking-console-plugin/pull/568)
* maintenance: Bump the npm group with 15 updates [#551](https://github.com/openshift/networking-console-plugin/pull/551)
* maintenance: Bump the npm group across 1 directory with 20 updates [#534](https://github.com/openshift/networking-console-plugin/pull/534)
* maintenance: Bump the npm group with 246 updates [#509](https://github.com/openshift/networking-console-plugin/pull/509)
* [OCPNETUI-82](https://issues.redhat.com/browse/OCPNETUI-82): Lower Dockerfile base image versions [#520](https://github.com/openshift/networking-console-plugin/pull/520)
* [OCPBUGS-98778](https://issues.redhat.com/browse/OCPBUGS-98778): Updating linkify-it to 5.0.2 to fix CVE-2026-48801 [#461](https://github.com/openshift/networking-console-plugin/pull/461)
* [Full changelog](https://github.com/openshift/networking-console-plugin/compare/788a4fa09547f838f504f376ff06ad2703ba985b...78539ca37fe487a44b1f83ad1286ddb2600539d9)


### [nutanix-cloud-controller-manager](https://github.com/openshift/cloud-provider-nutanix/tree/dc4d59c81b3dc23f0645239542be10a2c58c164f)

* [OCPBUGS-103705](https://issues.redhat.com/browse/OCPBUGS-103705): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.35.0-sec.4 to address CVE-2026-33814 [#76](https://github.com/openshift/cloud-provider-nutanix/pull/76)
* [Full changelog](https://github.com/openshift/cloud-provider-nutanix/compare/db1f264a7b04784e5f671e61cda0609695e555bb...dc4d59c81b3dc23f0645239542be10a2c58c164f)


### [oauth-apiserver](https://github.com/openshift/oauth-apiserver/tree/08eb2c2e9c01dd12f805723c72a3c155ea34fc56)

* [OCPBUGS-103704](https://issues.redhat.com/browse/OCPBUGS-103704): Replace golang.org/x/net with github.com/openshift-sustaining/net v0.35.0-sec.4 [#223](https://github.com/openshift/oauth-apiserver/pull/223)
* [Full changelog](https://github.com/openshift/oauth-apiserver/compare/5539eb2b1174fe0d8a65287c449c99ec3a362122...08eb2c2e9c01dd12f805723c72a3c155ea34fc56)


### [oauth-proxy](https://github.com/openshift/oauth-proxy/tree/06b0e773b6ef3d52813c000e1ad13c3be62bbd43)

* [OCPBUGS-136602](https://issues.redhat.com/browse/OCPBUGS-136602): [release-4.19] Sync OWNERS and OWNERS_ALIASES with master [#404](https://github.com/openshift/oauth-proxy/pull/404)
* [OCPBUGS-74133](https://issues.redhat.com/browse/OCPBUGS-74133): test/e2e - do not use ambiguous container image short names [#346](https://github.com/openshift/oauth-proxy/pull/346)
* [OCPBUGS-112092](https://issues.redhat.com/browse/OCPBUGS-112092): bugfix: rewrite open redirect strings to '/' [#383](https://github.com/openshift/oauth-proxy/pull/383)
* [Full changelog](https://github.com/openshift/oauth-proxy/compare/90d5efc25423c7ecb090bccb0a25c839e817dbf3...06b0e773b6ef3d52813c000e1ad13c3be62bbd43)


### [oauth-server](https://github.com/openshift/oauth-server/tree/f63474c3e7c76587deb9fb18ea1b861bed690900)

* [OCPBUGS-103695](https://issues.redhat.com/browse/OCPBUGS-103695): Replace golang.org/x/net with openshift-sustaining/net v0.43.0-sec.4 for CVE-2026-33814 [#282](https://github.com/openshift/oauth-server/pull/282)
* [OCPBUGS-87074](https://issues.redhat.com/browse/OCPBUGS-87074): bugfix: default to english when Accept-Language header contains more than 1000 underscores [#271](https://github.com/openshift/oauth-server/pull/271)
* [Full changelog](https://github.com/openshift/oauth-server/compare/88571ca76b4b039c33dec0b66e0a853b4447c8b1...f63474c3e7c76587deb9fb18ea1b861bed690900)


### [oc-mirror](https://github.com/openshift/oc-mirror/tree/7d72c0d980256b905282d35dd507b618b63dae1a)

* [OCPBUGS-129461](https://issues.redhat.com/browse/OCPBUGS-129461): v1 accept catalog root entries and relative symlink targets [#1577](https://github.com/openshift/oc-mirror/pull/1577)
* [Full changelog](https://github.com/openshift/oc-mirror/compare/9700b486d6b4b4625060caef2c2804c429d676fb...7d72c0d980256b905282d35dd507b618b63dae1a)


### [olm-catalogd, olm-operator-controller](https://github.com/openshift/operator-framework-operator-controller/tree/ec1174c7663e357dbace86033780ab1f1a74225f)

* [OCPBUGS-129018](https://issues.redhat.com/browse/OCPBUGS-129018): [release-4.19] clean up orphaned catalog cache temp dirs [#817](https://github.com/openshift/operator-framework-operator-controller/pull/817)
* [OCPBUGS-103696](https://issues.redhat.com/browse/OCPBUGS-103696), [OCPBUGS-103702](https://issues.redhat.com/browse/OCPBUGS-103702): Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#803](https://github.com/openshift/operator-framework-operator-controller/pull/803)
* [OCPBUGS-104519](https://issues.redhat.com/browse/OCPBUGS-104519): Fix cache path to avoid /var/cache/dnf conflict [#789](https://github.com/openshift/operator-framework-operator-controller/pull/789)
* [OCPBUGS-100313](https://issues.redhat.com/browse/OCPBUGS-100313): increase catalog HTTP client timeout from 10s to 5m [#784](https://github.com/openshift/operator-framework-operator-controller/pull/784)
* [Full changelog](https://github.com/openshift/operator-framework-operator-controller/compare/306ab2c907ab2ae238185021820468329c82c2fc...ec1174c7663e357dbace86033780ab1f1a74225f)


### [openshift-apiserver](https://github.com/openshift/openshift-apiserver/tree/9555f1be86f3a63774a38b465feefc07615eabf3)

* [OCPBUGS-103711](https://issues.redhat.com/browse/OCPBUGS-103711): Bump golang.org/x/net to v0.43.0-sec.3 [#679](https://github.com/openshift/openshift-apiserver/pull/679)
* [Full changelog](https://github.com/openshift/openshift-apiserver/compare/0a0123dc2dfb4a9148c1d0b3c032034555eb8969...9555f1be86f3a63774a38b465feefc07615eabf3)


### [openshift-controller-manager](https://github.com/openshift/openshift-controller-manager/tree/15a9435de87464d81acd2680bf086b10f5b833ef)

* [OCPBUGS-103700](https://issues.redhat.com/browse/OCPBUGS-103700): Use patched x/net fork v0.43.0-sec.4 [#458](https://github.com/openshift/openshift-controller-manager/pull/458)
* [Full changelog](https://github.com/openshift/openshift-controller-manager/compare/5b3063ff149f290bebca0783fc508dfbf07689a5...15a9435de87464d81acd2680bf086b10f5b833ef)


### [openshift-state-metrics](https://github.com/openshift/openshift-state-metrics/tree/df21ce19a2cc05aedf781cf7c7b674bd518bf658)

* NO-ISSUE: synchronize OWNERS from main branch [#152](https://github.com/openshift/openshift-state-metrics/pull/152)
* [Full changelog](https://github.com/openshift/openshift-state-metrics/compare/c604f81c4953f0feacfcf927cb5de883af027060...df21ce19a2cc05aedf781cf7c7b674bd518bf658)


### [openstack-resource-controller](https://github.com/openshift/openstack-resource-controller/tree/5baf297e587424d123f9e482dd42987f52f997ae)

* [OCPBUGS-103574](https://issues.redhat.com/browse/OCPBUGS-103574): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.4 to address CVE-2026-33814 [#46](https://github.com/openshift/openstack-resource-controller/pull/46)
* [Full changelog](https://github.com/openshift/openstack-resource-controller/compare/d00bab2b3029ead7cd0e2ae61c7d396239434b48...5baf297e587424d123f9e482dd42987f52f997ae)


### [operator-framework-tools, operator-lifecycle-manager, operator-registry](https://github.com/openshift/operator-framework-olm/tree/f6281d2dce8510e1cab53334694268c2b88b70ee)

* [OCPBUGS-103713](https://issues.redhat.com/browse/OCPBUGS-103713), [OCPBUGS-103714](https://issues.redhat.com/browse/OCPBUGS-103714), [OCPBUGS-103716](https://issues.redhat.com/browse/OCPBUGS-103716): Replace golang.org/x/net with github.com/openshift-sustaining/net@v0.43.0-sec.3- #1365 [#1365](https://github.com/openshift/operator-framework-olm/pull/1365)
* [Full changelog](https://github.com/openshift/operator-framework-olm/compare/c606498ade273e9392d6b10713a1e926c09095b0...f6281d2dce8510e1cab53334694268c2b88b70ee)


### [ovn-kubernetes, ovn-kubernetes-microshift](https://github.com/openshift/ovn-kubernetes/tree/f50842657ce6358847b981330921cd162b9b7405)

* [OCPBUGS-136479](https://issues.redhat.com/browse/OCPBUGS-136479): Branch Sync release-4.20 to release-4.19 [11-02-2026] [#3595](https://github.com/openshift/ovn-kubernetes/pull/3595)
* [OCPBUGS-136124](https://issues.redhat.com/browse/OCPBUGS-136124): NO-JIRA: Branch Sync release-4.20 to release-4.19 [10-29-2026] [#3588](https://github.com/openshift/ovn-kubernetes/pull/3588)
* [OCPBUGS-128427](https://issues.redhat.com/browse/OCPBUGS-128427): Branch Sync release-4.20 to release-4.19 [10-22-2026] [#3569](https://github.com/openshift/ovn-kubernetes/pull/3569)
* [OCPBUGS-132715](https://issues.redhat.com/browse/OCPBUGS-132715): Branch Sync release-4.20 to release-4.19 [10-16-2026] [#3554](https://github.com/openshift/ovn-kubernetes/pull/3554)
* [OCPBUGS-129151](https://issues.redhat.com/browse/OCPBUGS-129151): Branch Sync release-4.20 to release-4.19 [10-05-2026] [#3510](https://github.com/openshift/ovn-kubernetes/pull/3510)
* [OCPBUGS-111880](https://issues.redhat.com/browse/OCPBUGS-111880), [OCPBUGS-111887](https://issues.redhat.com/browse/OCPBUGS-111887): Branch Sync release-4.20 to release-4.19 [08-18-2026] [#3403](https://github.com/openshift/ovn-kubernetes/pull/3403)
* [OCPBUGS-95077](https://issues.redhat.com/browse/OCPBUGS-95077): Branch Sync release-4.20 to release-4.19 [08-11-2026] [#3380](https://github.com/openshift/ovn-kubernetes/pull/3380)
* [OCPBUGS-105881](https://issues.redhat.com/browse/OCPBUGS-105881): Add pperiyasamy to OWNERS for release-4.19 [#3387](https://github.com/openshift/ovn-kubernetes/pull/3387)
* [OCPBUGS-98616](https://issues.redhat.com/browse/OCPBUGS-98616): Branch Sync release-4.20 to release-4.19 [07-09-2026] [#3289](https://github.com/openshift/ovn-kubernetes/pull/3289)
* [OCPBUGS-82825](https://issues.redhat.com/browse/OCPBUGS-82825): Bump github.com/moby/spdystream to v0.5.1 [#3320](https://github.com/openshift/ovn-kubernetes/pull/3320)
* [Full changelog](https://github.com/openshift/ovn-kubernetes/compare/767a5511bc0e65c1c6982113c477b37df1d3e2be...f50842657ce6358847b981330921cd162b9b7405)


### [powervs-block-csi-driver-operator](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/tree/edc06e4a27944a6e8ce64ccab50ad2ede85f536b)

* [OCPBUGS-86917](https://issues.redhat.com/browse/OCPBUGS-86917): Updating ose-powervs-block-csi-driver-operator-container image to be consistent with ART for 4.19 [#116](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/pull/116)
* [Full changelog](https://github.com/openshift/ibm-powervs-block-csi-driver-operator/compare/ad49862f7580502d75985117bb52bafb78d8ee78...edc06e4a27944a6e8ce64ccab50ad2ede85f536b)


### [prom-label-proxy](https://github.com/openshift/prom-label-proxy/tree/7e940516469fd79e74ab09828935c06b17f2834a)

* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#412](https://github.com/openshift/prom-label-proxy/pull/412)
* [Full changelog](https://github.com/openshift/prom-label-proxy/compare/13666465233bfe72a19d6d3f48576a508fdea145...7e940516469fd79e74ab09828935c06b17f2834a)


### [prometheus](https://github.com/openshift/prometheus/tree/df7cd414210e07b98fe544889f0a3209b0b3da36)

* NO-ISSUE: synchronize OWNERS from main branch [#382](https://github.com/openshift/prometheus/pull/382)
* [OCPBUGS-93706](https://issues.redhat.com/browse/OCPBUGS-93706): fix for CVE-2026-42151 [#360](https://github.com/openshift/prometheus/pull/360)
* [Full changelog](https://github.com/openshift/prometheus/compare/6ab29bbc7903e6493b6e1b5aaf3e0df26ac47295...df7cd414210e07b98fe544889f0a3209b0b3da36)


### [prometheus-alertmanager](https://github.com/openshift/prometheus-alertmanager/tree/9492b20ccfb409add6831d7ff482082b943f7bbe)

* NO-JIRA: synchronize OWNERS with main [#191](https://github.com/openshift/prometheus-alertmanager/pull/191)
* [OCPBUGS-103733](https://issues.redhat.com/browse/OCPBUGS-103733): Use github.com/openshift-sustaining/net patch to fix CVE-2026-33814 [#171](https://github.com/openshift/prometheus-alertmanager/pull/171)
* [OCPBUGS-98179](https://issues.redhat.com/browse/OCPBUGS-98179): fixes CVE-2026-14362 [#161](https://github.com/openshift/prometheus-alertmanager/pull/161)
* [OCPBUGS-100354](https://issues.redhat.com/browse/OCPBUGS-100354): Set testdata CA expiry to 20 years from issue date (#4112) [#150](https://github.com/openshift/prometheus-alertmanager/pull/150)
* [Full changelog](https://github.com/openshift/prometheus-alertmanager/compare/66b6f1a6fafa7181bd04b9df6dede2c511644dc6...9492b20ccfb409add6831d7ff482082b943f7bbe)


### [prometheus-config-reloader, prometheus-operator, prometheus-operator-admission-webhook](https://github.com/openshift/prometheus-operator/tree/29665bbf880b2af3efd70efddaba303fa004ab22)

* NO-ISSUE: synchronize OWNERS from main branch [#410](https://github.com/openshift/prometheus-operator/pull/410)
* [OCPBUGS-103729](https://issues.redhat.com/browse/OCPBUGS-103729), [OCPBUGS-103735](https://issues.redhat.com/browse/OCPBUGS-103735): [release-4.19] Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [#396](https://github.com/openshift/prometheus-operator/pull/396)
* [Full changelog](https://github.com/openshift/prometheus-operator/compare/40703af366f376665b8b0c303233463845de285c...29665bbf880b2af3efd70efddaba303fa004ab22)


### [prometheus-node-exporter](https://github.com/openshift/node_exporter/tree/c5f33cf4bc98b6118ca0fb23b1d8681092caf93e)

* [OCPBUGS-103732](https://issues.redhat.com/browse/OCPBUGS-103732): CVE-2026-33814 openshift4/ose-prometheus-node-exporter-rhel9: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame [openshift-4.19] [#215](https://github.com/openshift/node_exporter/pull/215)
* NO-ISSUE: synchronize OWNERS from main branch [release-4.19] [#201](https://github.com/openshift/node_exporter/pull/201)
* [Full changelog](https://github.com/openshift/node_exporter/compare/c90542d8cef6d25545ae00481ffff5622cdce928...c5f33cf4bc98b6118ca0fb23b1d8681092caf93e)


### [rhel-coreos, rhel-coreos-extensions](https://github.com/openshift/os/tree/3522fbaca282ebdb5abd999babc2ee71d5b0d030)

* [OCPBUGS-109661](https://issues.redhat.com/browse/OCPBUGS-109661): NetworkManager-ovs has moved to RHCOS [#1960](https://github.com/openshift/os/pull/1960)
* [Full changelog](https://github.com/openshift/os/compare/48a00b3b021336fe75a4f104af5383cc7589c5a0...3522fbaca282ebdb5abd999babc2ee71d5b0d030)


### [route-controller-manager](https://github.com/openshift/route-controller-manager/tree/d169cd1731a15639fc10d1e4faa0fba52f1b033e)

* [OCPBUGS-103575](https://issues.redhat.com/browse/OCPBUGS-103575): Fix CVE-2026-33814 by adding patch for golang.org/x/net package [#109](https://github.com/openshift/route-controller-manager/pull/109)
* [Full changelog](https://github.com/openshift/route-controller-manager/compare/6068e2c71fc1efb67324a91f48c1470c647f1344...d169cd1731a15639fc10d1e4faa0fba52f1b033e)


### [tests](https://github.com/openshift/origin/tree/94e363b5b3bf9c6a6bc6b8388ee2eda388a2da1c)

* [OCPBUGS-132839](https://issues.redhat.com/browse/OCPBUGS-132839): Remove restriction of unmanaged x-k8s.io [#31790](https://github.com/openshift/origin/pull/31790)
* [OCPBUGS-130855](https://issues.redhat.com/browse/OCPBUGS-130855): stage the creation of test pods to minimize etcd impact [#31739](https://github.com/openshift/origin/pull/31739)
* [OCPBUGS-121957](https://issues.redhat.com/browse/OCPBUGS-121957): Raise status polling timeout and write bound [#31622](https://github.com/openshift/origin/pull/31622)
* [OCPBUGS-100441](https://issues.redhat.com/browse/OCPBUGS-100441): retry GetVotingMemberNames on transient etcd client fails [#31509](https://github.com/openshift/origin/pull/31509)
* [OCPBUGS-104577](https://issues.redhat.com/browse/OCPBUGS-104577): Backport node_e2e test migrations [#31484](https://github.com/openshift/origin/pull/31484)
* [OCPBUGS-100045](https://issues.redhat.com/browse/OCPBUGS-100045): Add openshift/disruptive-longrunning testsuite in release-4.19 [#31438](https://github.com/openshift/origin/pull/31438)
* [Full changelog](https://github.com/openshift/origin/compare/1340d0444b8d0fec60957689e1e2f5c6fb9a2dde...94e363b5b3bf9c6a6bc6b8388ee2eda388a2da1c)


### [vsphere-cloud-controller-manager](https://github.com/openshift/cloud-provider-vsphere/tree/c6295e83eb08043e9567ea1abb9266ba7337013c)

* [OCPBUGS-103752](https://issues.redhat.com/browse/OCPBUGS-103752): Replace golang.org/x/net with sustaining fork for CVE-2026-33814 in 4.19 [#134](https://github.com/openshift/cloud-provider-vsphere/pull/134)
* [Full changelog](https://github.com/openshift/cloud-provider-vsphere/compare/ce0f10cbccf0a7427bfa66df86187a5b2e184974...c6295e83eb08043e9567ea1abb9266ba7337013c)


### [vsphere-cluster-api-controllers](https://github.com/openshift/cluster-api-provider-vsphere/tree/2c28abc347727ce9c283c63a540915b3efee1af7)

* [OCPBUGS-103755](https://issues.redhat.com/browse/OCPBUGS-103755): Bump golang.org/x/net to github.com/openshift-sustaining/net v0.43.0-sec.4 CVE-2026-33814 [release-4.19] [#125](https://github.com/openshift/cluster-api-provider-vsphere/pull/125)
* [Full changelog](https://github.com/openshift/cluster-api-provider-vsphere/compare/87699d7edbe20ceb08760581c0eebae59265d821...2c28abc347727ce9c283c63a540915b3efee1af7)


### [vsphere-csi-driver, vsphere-csi-driver-syncer](https://github.com/openshift/vmware-vsphere-csi-driver/tree/cdfc07bc087c7c208e6fce4804a2ed1ada88de94)

* [OCPBUGS-103750](https://issues.redhat.com/browse/OCPBUGS-103750), [OCPBUGS-103751](https://issues.redhat.com/browse/OCPBUGS-103751): Use patched x/net fork v0.43.0-sec.4 [#211](https://github.com/openshift/vmware-vsphere-csi-driver/pull/211)
* [OCPBUGS-92935](https://issues.redhat.com/browse/OCPBUGS-92935): Bump golang.org/x/crypto/ssh to v0.41.0-sec.2 [#192](https://github.com/openshift/vmware-vsphere-csi-driver/pull/192)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver/compare/4af5e765c661136c58490b27627a597469fea375...cdfc07bc087c7c208e6fce4804a2ed1ada88de94)


### [vsphere-csi-driver-operator](https://github.com/openshift/vmware-vsphere-csi-driver-operator/tree/0121c1381f7d0215cf0b24cfbdbe12857ca065e2)

* [OCPBUGS-103754](https://issues.redhat.com/browse/OCPBUGS-103754): Bump golang.org/x/net to v0.43.0-sec.3 [#355](https://github.com/openshift/vmware-vsphere-csi-driver-operator/pull/355)
* [Full changelog](https://github.com/openshift/vmware-vsphere-csi-driver-operator/compare/c8a4359510f52ebdb30210049b1d2058e62eb7fd...0121c1381f7d0215cf0b24cfbdbe12857ca065e2)


### [vsphere-problem-detector](https://github.com/openshift/vsphere-problem-detector/tree/995d91a8586a90b256207b988e9bd246f1c3cfd1)

* [OCPBUGS-123520](https://issues.redhat.com/browse/OCPBUGS-123520): Fixed compute cluster permission logic for single fd with read-only custom resourcepool [#240](https://github.com/openshift/vsphere-problem-detector/pull/240)
* [OCPBUGS-103758](https://issues.redhat.com/browse/OCPBUGS-103758): Bump golang.org/x/net to v0.43.0-sec.4 [#232](https://github.com/openshift/vsphere-problem-detector/pull/232)
* [Full changelog](https://github.com/openshift/vsphere-problem-detector/compare/7b8e065fef1a8a4a43f023abc777c3b6b6bcb3a7...995d91a8586a90b256207b988e9bd246f1c3cfd1)